Archived Support Site

This support site is archived. You can view the old support discussions but you cannot post new discussions.

Home → Support →

HTTPS for Static Files

acobby77's Avatar

acobby77

Apr 18, 2016 @ 12:19 AM

I have a requirement to ensure all traffic on my website is redirected to HTTPS if it is requested over HTTP. When we deploy the site to appharbor, we use the custom RequireHttpsAttribute which works well for our ASP.NET application.

However we also want to force any request for static files (images, stylesheets, javascript) via HTTP to be sent to HTTPS.

Does anyone have any ideas on how to achieve this?

  1. Support Staff 1 Posted by rune on Apr 20, 2016 @ 07:09 AM

    rune's Avatar

    Hi,

    How are you serving the static files? If the files are processed in your code (typically applies if you have runAllManagedModulesForAllRequests set to true) you could just implement some code similar to the custom RequireHttpsAttribute for static files as well. Otherwise I suspect you'll have to implement a redirect using the IIS rewrite module (something similar to this solution should work).

    If however you're not serving sensitive content over HTTPS I think you should simply make sure that all the static files referenced in the generated HTML points to the HTTPS-enabled static file URLs -- this was all the static assets will be served over HTTPS without any redirects which is both faster and safer. It'll likely eliminate the need to redirect non-HTTPS static files requests altogether.

    I hope this helps! If you're still having trouble with this it'd be great if you could send over a link to a page where you're experiencing issues with this so I can take a closer look.

    Best,
    Rune

  2. rune closed this discussion on Apr 20, 2016 @ 07:09 AM.

  3. acobby77 re-opened this discussion on Apr 21, 2016 @ 06:35 AM

  4. 2 Posted by acobby77 on Apr 21, 2016 @ 06:35 AM

    acobby77's Avatar

    Thanks Rune,

    All the static files referenced in our HTML are pointing to the HTTPS
    version of the file. So the requirement is more to prevent users from
    accessing files by typing the http URL directly into the browser.

    We have the runAllManagedModulesForAllRequests set to true, so I was able
    to create a module that checked the incoming request, and redirect from
    there, similar to what the RequireHttpsAttribute does for MVC controllers.

    Thanks,
    Tony

  5. Support Staff 3 Posted by rune on Apr 21, 2016 @ 08:17 AM

    rune's Avatar

    Ok great! Let me know if there's anything else I can help with.

    Best,
    Rune

  6. rune closed this discussion on Apr 21, 2016 @ 08:17 AM.

Discussions are closed to public comments.
If you need help with AppHarbor please start a new discussion.

Keyboard shortcuts

Generic

? Show this help
ESC Blurs the current field

Comment Form

r Focus the comment reply box
^ + ↩ Submit the comment

You can use Command ⌘ instead of Control ^ on Mac