ASP.NET Webforms 中的部分 SSL，无需更改 IIS 配置 [英] Partial SSL in ASP.NET Webforms without changing IIS configuration

问题描述

我们有一个非常简单的 ASP.NET Web 应用程序，主要包含静态内容和我们希望使用 SSL 保护的单一表单.受保护的页面位于其自己的文件夹中，但它继承自未受保护的母版页，并与网站的其余部分共享一些其他资源(徽标、css 文件和一些图片).该站点由第三方托管，无法更改 IIS 配置(或更改为其他主机).

We have a very simple ASP.NET web application comprising mostly static content and a single form which we want to protect with SSL. The secured page is in its own folder, but it inherits from an unsecured master page, and it shares some other resources (the logo, css file and some pictures) with the rest of the website. The site is hosted by a third-party, and changing the IIS configuration (or changing to a different host) is not an option.

据我们了解，在 ASP.NET 上处理部分 SSL 时存在一些挑战:

As we understand, there are a few challenges when dealing with partial SSL on ASP.NET:

1. 防止出现此页面同时包含安全和非安全项目"消息.
2. 提供对相对 URL 的支持，因为它们在重定向到安全页面时默认不起作用.

我们不想保护整个站点，因为潜在的性能问题，那么只保护一个特定页面或文件夹的最佳方法是什么，同时保证该页面加载的任何资源都将被安全吗?

We don’t want to secure the whole site, because of the potential performance issues, so what is the best way to protect only one particular page or folder, guaranteeing at the same time that any resource loaded by this page will be secured as well?

推荐答案

我最终使用描述的解决方案覆盖了我想要保护的页面上的 OnInit 方法 这里:

I ended up overriding the OnInit method on the page I wanted to secure, using the solution described here:

protected override void OnInit(EventArgs e)
{
    if (!Request.IsSecureConnection && !Request.IsLocal)
    {
        UriBuilder builder = new UriBuilder(Request.Url)
        {
            Scheme = Uri.UriSchemeHttps,
            Port = 443
        };
        Response.Redirect(builder.Uri.ToString());
    }
    base.OnInit(e);
}

对于其余的页面，我从基础页面继承了 OnInit 方法的以下代码:

For the rest of the pages, I inherited from a base page with the following code on the OnInit method:

protected override void OnInit(EventArgs e)
{
    if (Request.IsSecureConnection)
    {
        UriBuilder builder = new UriBuilder(Request.Url)
        {
            Scheme = Uri.UriSchemeHttp,
            Port = 80
        };
        Response.Redirect(builder.Uri.ToString());
    }
    base.OnInit(e);
}

这篇关于ASP.NET Webforms 中的部分 SSL，无需更改 IIS 配置的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！