asp.net - Use setting in session to set SSL enforcement -
i have below code in global.ascx. works fine when debugging, on live site causes issues related session, appears session not available/created @ points, blows up. setting stored in session (appsettings.issslenforced retreived session), have read there, right thinking of perhaps putting in master page, feel leave requests vulnerable. there better alternative?
protected void application_beginrequest(object sender, eventargs e) { try { if (!request.issecureconnection && appsettings.issslenforced) { response.redirect(request.url.tostring().replace("http:", "https:")); } } catch (exception ex) { logmanager.inserterrorlog(ex); } }
try using application_prerequesthandlerexecute rather application_beginrequest:
protected void application_prerequesthandlerexecute(object sender, eventargs e) { try { if (!request.issecureconnection && appsettings.issslenforced) { response.redirect(request.url.tostring().replace("http:", "https:")); } } catch (exception ex) { logmanager.inserterrorlog(ex); } }
Comments
Post a Comment