Most sites out there have some portions that should be only served via HTTPS, while the remainder can be HTTP, such as account pages and content pages respectively. This is sometimes called a “partially secured site.”
Starting with MVC 2, you could decorate controllers and actions with the RequireHttps attribute, which would redirect non-secure GET requests to HTTPS. Unfortunately, once you are in HTTPS, you won’t automatically switch back to HTTP for those actions that do not require it.
To do that, you can override OnActionExecuting in your base controller (to save you from having to reimplement the call in each of your actual controllers) and redirect the user.
Here’s the code
[RequireHttps]
public ActionResult MySslAction()
{
// HTTPS
}
public ActionResult MyNonSslAction()
{
// HTTP
}
protected override void OnActionExecuting(ActionExecutingContext filterContext)
{
if (filterContext.HttpContext.Request.IsSecureConnection && !filterContext.ActionDescriptor.IsDefined(typeof(RequireHttpsAttribute), true))
{
// redirect to un-secured page
string url = "http://" + filterContext.HttpContext.Request.Url.Host + filterContext.HttpContext.Request.RawUrl;
filterContext.HttpContext.Response.Redirect(url);
}
base.OnActionExecuting(filterContext);
}
public ActionResult MySslAction()
{
// HTTPS
}
public ActionResult MyNonSslAction()
{
// HTTP
}
protected override void OnActionExecuting(ActionExecutingContext filterContext)
{
if (filterContext.HttpContext.Request.IsSecureConnection && !filterContext.ActionDescriptor.IsDefined(typeof(RequireHttpsAttribute), true))
{
// redirect to un-secured page
string url = "http://" + filterContext.HttpContext.Request.Url.Host + filterContext.HttpContext.Request.RawUrl;
filterContext.HttpContext.Response.Redirect(url);
}
base.OnActionExecuting(filterContext);
}