blocks|key|1732879|text|如果您使用的是ASP.NET+MVC+2+Preview+2+or+higher，您现在可以简单地使用：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1732880|[RequireHttps]
public+ActionResult+Login()
{
+++return+View();
}|code-block|syntax|javascript|1732881|不过，作为mentioned+here，order参数值得注意。|1732882|entityMap|0|LINK|mutability|MUTABLE|url|http://blogs.teamb.com/craigstuntz/2009/10/05/38476/|1|http://bartwullems.blogspot.com/2010/01/using-ssl-with-aspnet-mvc-2.html^0|7|X|0|0|0|5|E|1|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@$A|V|B|W|1|X]]|C|$]]|$1|D|3|E|5|F|7|Y|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|Z|8|@]|9|@$A|10|B|11|1|12]]|C|$]]|$1|K|3|-4|5|6|7|13|8|@]|9|@]|C|$]]]|L|$M|$5|N|O|P|C|$Q|R]]|S|$5|N|O|P|C|$Q|T]]]]

If you are using <a href="http://blogs.teamb.com/craigstuntz/2009/10/05/38476/" rel="noreferrer">ASP.NET MVC 2 Preview 2 or higher</a>, you can now simply use:

<pre><code>[RequireHttps]
public ActionResult Login()
{
 return View();
}
</code></pre>

Though, the order parameter is worth noting, as <a href="http://bartwullems.blogspot.com/2010/01/using-ssl-with-aspnet-mvc-2.html" rel="noreferrer">mentioned here</a>.

blocks|key|1732775|text|MVCFutures有一个'RequireSSL‘属性。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1732776|(在你更新的博客文章中感谢亚当的pointing+that+out+)|1732777|只需将其应用于您的操作方法，如果您希望Redirect=true://请求自动变为https://：|1732778|++++[RequireSsl(Redirect+=+true)]|code-block|syntax|javascript|1732779|另请参阅：ASP.NET+MVC+RequireHttps+in+Production+Only|1732780|entityMap|0|LINK|mutability|MUTABLE|url|http://aspnet.codeplex.com/Release/ProjectReleases.aspx?ReleaseId=24471|1|http://blog.salvoz.com/2009/04/25/PartialSSLAndAuthorizationWithAspNetMVCRevisited.aspx|2|https://stackoverflow.com/questions/1639707/asp-net-mvc-requirehttps-in-production-only/1639831#1639831^0|0|A|0|0|G|H|1|0|0|0|5|17|2|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@$A|11|B|12|1|13]]|C|$]]|$1|D|3|E|5|6|7|14|8|@]|9|@$A|15|B|16|1|17]]|C|$]]|$1|F|3|G|5|6|7|18|8|@]|9|@]|C|$]]|$1|H|3|I|5|J|7|19|8|@]|9|@]|C|$K|L]]|$1|M|3|N|5|6|7|1A|8|@]|9|@$A|1B|B|1C|1|1D]]|C|$]]|$1|O|3|-4|5|6|7|1E|8|@]|9|@]|C|$]]]|P|$Q|$5|R|S|T|C|$U|V]]|W|$5|R|S|T|C|$U|X]]|Y|$5|R|S|T|C|$U|Z]]]]

<a href="http://aspnet.codeplex.com/Release/ProjectReleases.aspx?ReleaseId=24471" rel="nofollow noreferrer">MVCFutures</a> has a 'RequireSSL' attribute.

(thanks Adam for <a href="http://blog.salvoz.com/2009/04/25/PartialSSLAndAuthorizationWithAspNetMVCRevisited.aspx" rel="nofollow noreferrer">pointing that out</a> in your updated blogpost)

Just apply it to your action method, with 'Redirect=true' if you want an http:// request to automatically become https:// :

<pre><code> [RequireSsl(Redirect = true)]
</code></pre>

See also: <a href="https://stackoverflow.com/questions/1639707/asp-net-mvc-requirehttps-in-production-only/1639831#1639831">ASP.NET MVC RequireHttps in Production Only</a>

blocks|key|1517784|text|以下是Dan+Wahlin最近发布的一篇文章：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1517785|http://weblogs.asp.net/dwahlin/archive/2009/08/25/requiring-ssl-for-asp-net-mvc-controllers.aspx|offset|length|1517786|他使用ActionFilter属性。|1517787|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|2O|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@$D|Q|E|R|1|S]]|A|$]]|$1|F|3|G|5|6|7|T|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|U|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|C]]]]

Here's a recent post from Dan Wahlin on this:

<a href="http://weblogs.asp.net/dwahlin/archive/2009/08/25/requiring-ssl-for-asp-net-mvc-controllers.aspx" rel="noreferrer">http://weblogs.asp.net/dwahlin/archive/2009/08/25/requiring-ssl-for-asp-net-mvc-controllers.aspx</a>

He uses an ActionFilter Attribute.

blocks|key|1517535|text|一些ActionLink扩展：http://www.squaredroot.com/post/2008/06/11/MVC-and-SSL.aspx或重定向到http://forums.asp.net/p/1260198/2358380.aspx#2358380的控制器操作属性|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1517536|entityMap|0|LINK|mutability|MUTABLE|url|http://www.squaredroot.com/post/2008/06/11/MVC-and-SSL.aspx|1|http://forums.asp.net/p/1260198/2358380.aspx#2358380^0|F|1N|0|27|1G|1|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]|$A|R|B|S|1|T]]|C|$]]|$1|D|3|-4|5|6|7|U|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]|L|$5|G|H|I|C|$J|M]]]]

Some ActionLink extensions: <a href="http://www.squaredroot.com/post/2008/06/11/MVC-and-SSL.aspx" rel="nofollow noreferrer">http://www.squaredroot.com/post/2008/06/11/MVC-and-SSL.aspx</a>
Or an controller action attribute that redirects to https:// <a href="http://forums.asp.net/p/1260198/2358380.aspx#2358380" rel="nofollow noreferrer">http://forums.asp.net/p/1260198/2358380.aspx#2358380</a>

blocks|key|1517986|text|对于那些不喜欢面向属性的开发方法的人，这里有一段代码可能会有所帮助：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1517987|public+static+readonly+string[]+SecurePages+=+new[]+{+"login",+"join"+};
protected+void+Application_AuthorizeRequest(object+sender,+EventArgs+e)
{
++++var+pageName+=+RequestHelper.GetPageNameOrDefault();
++++if+(!HttpContext.Current.Request.IsSecureConnection
++++++++&&+(HttpContext.Current.Request.IsAuthenticated+%7C%7C+SecurePages.Contains(pageName)))
++++{
++++++++Response.Redirect("https://"+%2B+Request.ServerVariables["HTTP_HOST"]+%2B+HttpContext.Current.Request.RawUrl);
++++}
++++if+(HttpContext.Current.Request.IsSecureConnection
++++++++&&+!HttpContext.Current.Request.IsAuthenticated
++++++++&&+!SecurePages.Contains(pageName))
++++{
++++++++Response.Redirect("http://"+%2B+Request.ServerVariables["HTTP_HOST"]+%2B+HttpContext.Current.Request.RawUrl);
++++}
}|code-block|syntax|javascript|1517988|避免使用属性有几个原因，其中之一是，如果您想查看所有受保护页面的列表，则必须跳过解决方案中的所有控制器。|1517989|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

For those who are not a fan of attribute-oriented development approaches, here is a piece of code that could help:

<pre><code>public static readonly string[] SecurePages = new[] { "login", "join" };
protected void Application_AuthorizeRequest(object sender, EventArgs e)
{
 var pageName = RequestHelper.GetPageNameOrDefault();
 if (!HttpContext.Current.Request.IsSecureConnection
 &amp;&amp; (HttpContext.Current.Request.IsAuthenticated || SecurePages.Contains(pageName)))
 {
 Response.Redirect("https://" + Request.ServerVariables["HTTP_HOST"] + HttpContext.Current.Request.RawUrl);
 }
 if (HttpContext.Current.Request.IsSecureConnection
 &amp;&amp; !HttpContext.Current.Request.IsAuthenticated
 &amp;&amp; !SecurePages.Contains(pageName))
 {
 Response.Redirect("http://" + Request.ServerVariables["HTTP_HOST"] + HttpContext.Current.Request.RawUrl);
 }
}
</code></pre>

There are several reasons to avoid attributes and one of them is if you want to look at the list of all secured pages you will have to jump over all controllers in solution.

blocks|key|1518080|text|我遇到了这个问题，希望我的解决方案能帮助到一些人。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1518081|我们遇到了一些问题：-我们需要保护特定的操作，例如"Account“中的"LogOn”。我们可以使用build+in+RequireHttps属性，这很棒--但是它会用https://.重定向我们-我们应该让我们的链接，表单和这样的"SSL感知“。|1518082|通常，除了能够指定协议之外，我的解决方案还允许指定使用绝对url的路由。您可以使用此方法指定"https“协议。|1518083|所以，首先我创建了一个ConnectionProtocol枚举：|1518084|///+<summary>
///+Enum+representing+the+available+secure+connection+requirements
///+</summary>
public+enum+ConnectionProtocol
{
++++///+<summary>
++++///+No+secure+connection+requirement
++++///+</summary>
++++Ignore,

++++///+<summary>
++++///+No+secure+connection+should+be+used,+use+standard+http+request.
++++///+</summary>
++++Http,

++++///+<summary>
++++///+The+connection+should+be+secured+using+SSL+(https+protocol).
++++///+</summary>
++++Https
}|code-block|syntax|javascript|1518085|现在，我已经创建了RequireSsl的手写版本。我已经修改了原始的RequireSsl源代码，允许重定向到http://+urls。此外，我还添加了一个字段，允许我们确定是否需要SSL+(我将其与调试预处理器一起使用)。|1518086|/*+Note:
+*+This+is+hand-rolled+version+of+the+original+System.Web.Mvc.RequireHttpsAttribute.
+*+This+version+contains+three+improvements:
+*+-+Allows+to+redirect+back+into+http://+addresses,+based+on+the+<see+cref="SecureConnectionRequirement"+/>+Requirement+property.
+*+-+Allows+to+turn+the+protocol+scheme+redirection+off+based+on+given+condition.
+*+-+Using+Request.IsCurrentConnectionSecured()+extension+method,+which+contains+fix+for+load-balanced+servers.
+*/
[AttributeUsage(AttributeTargets.Class+%7C+AttributeTargets.Method,+Inherited+=+true,+AllowMultiple+=+false)]
public+sealed+class+RequireHttpsAttribute+:+FilterAttribute,+IAuthorizationFilter
{
++++public+RequireHttpsAttribute()
++++{
++++++++Protocol+=+ConnectionProtocol.Ignore;
++++}

++++///+<summary>
++++///+Gets+or+sets+the+secure+connection+required+protocol+scheme+level
++++///+</summary>
++++public+ConnectionProtocol+Protocol+{+get;+set;+}

++++///+<summary>
++++///+Gets+the+value+that+indicates+if+secure+connections+are+been+allowed
++++///+</summary>
++++public+bool+SecureConnectionsAllowed
++++{
++++++++get
++++++++{
#if+DEBUG
++++++++++++return+false;
#else
++++++++++++return+true;
#endif
++++++++}
++++}

++++public+void+OnAuthorization(System.Web.Mvc.AuthorizationContext+filterContext)
++++{
++++++++if+(filterContext+==+null)
++++++++{
++++++++++++throw+new+ArgumentNullException("filterContext");
++++++++}

++++++++/*+Are+we+allowed+to+use+secure+connections?+*/
++++++++if+(!SecureConnectionsAllowed)
++++++++++++return;

++++++++switch+(Protocol)
++++++++{
++++++++++++case+ConnectionProtocol.Https:
++++++++++++++++if+(!filterContext.HttpContext.Request.IsCurrentConnectionSecured())
++++++++++++++++{
++++++++++++++++++++HandleNonHttpsRequest(filterContext);
++++++++++++++++}
++++++++++++++++break;
++++++++++++case+ConnectionProtocol.Http:
++++++++++++++++if+(filterContext.HttpContext.Request.IsCurrentConnectionSecured())
++++++++++++++++{
++++++++++++++++++++HandleNonHttpRequest(filterContext);
++++++++++++++++}
++++++++++++++++break;
++++++++}
++++}


++++private+void+HandleNonHttpsRequest(AuthorizationContext+filterContext)
++++{
++++++++//+only+redirect+for+GET+requests,+otherwise+the+browser+might+not+propagate+the+verb+and+request
++++++++//+body+correctly.

++++++++if+(!String.Equals(filterContext.HttpContext.Request.HttpMethod,+"GET",+StringComparison.OrdinalIgnoreCase))
++++++++{
++++++++++++throw+new+InvalidOperationException("The+requested+resource+can+only+be+accessed+via+SSL.");
++++++++}

++++++++//+redirect+to+HTTPS+version+of+page
++++++++string+url+=+"https://"+%2B+filterContext.HttpContext.Request.Url.Host+%2B+filterContext.HttpContext.Request.RawUrl;
++++++++filterContext.Result+=+new+RedirectResult(url);
++++}

++++private+void+HandleNonHttpRequest(AuthorizationContext+filterContext)
++++{
++++++++if+(!String.Equals(filterContext.HttpContext.Request.HttpMethod,+"GET",+StringComparison.OrdinalIgnoreCase))
++++++++{
++++++++++++throw+new+InvalidOperationException("The+requested+resource+can+only+be+accessed+without+SSL.");
++++++++}

++++++++//+redirect+to+HTTP+version+of+page
++++++++string+url+=+"http://"+%2B+filterContext.HttpContext.Request.Url.Host+%2B+filterContext.HttpContext.Request.RawUrl;
++++++++filterContext.Result+=+new+RedirectResult(url);
++++}
}|1518087|现在，此RequireSsl将根据您的需求属性值执行以下操作：-+Ignore:不会执行任何操作。-+Http:将强制重定向到http协议。-+Https:将强制重定向到https协议。|1518088|您应该创建自己的基本控制器，并将此属性设置为Http。|1518089|[RequireSsl(Requirement+=+ConnectionProtocol.Http)]
public+class+MyController+:+Controller
{
++++public+MyController()+{+}
}|1518090|现在，在每个需要SSL的cpntroller/action中，只需使用ConnectionProtocol.Https设置此属性即可。|1518091|现在让我们来看看URLs:我们在url路由引擎上遇到的问题很少。你可以在http://blog.stevensanderson.com/2008/08/05/adding-httpsssl-support-to-aspnet-mvc-routing/上阅读更多关于它们的信息。这篇文章中建议的解决方案理论上是好的，但很陈旧，我不喜欢这种方法。|offset|length|1518092|我的解决方案如下:创建一个基本"Route“类的子类：|1518093|公有类AbsoluteUrlRoute+:+Route+{+#region+ctor|1518094|++++///+<summary>
++++///+Initializes+a+new+instance+of+the+System.Web.Routing.Route+class,+by+using
++++///+++++the+specified+URL+pattern+and+handler+class.
++++///+</summary>
++++///+<param+name="url">The+URL+pattern+for+the+route.</param>
++++///+<param+name="routeHandler">The+object+that+processes+requests+for+the+route.</param>
++++public+AbsoluteUrlRoute(string+url,+IRouteHandler+routeHandler)
++++++++:+base(url,+routeHandler)
++++{

++++}

++++///+<summary>
++++///+Initializes+a+new+instance+of+the+System.Web.Routing.Route+class,+by+using
++++///+++++the+specified+URL+pattern+and+handler+class.
++++///+</summary>
++++///+<param+name="url">The+URL+pattern+for+the+route.</param>
++++///+<param+name="defaults">The+values+to+use+for+any+parameters+that+are+missing+in+the+URL.</param>
++++///+<param+name="routeHandler">The+object+that+processes+requests+for+the+route.</param>
++++public+AbsoluteUrlRoute(string+url,+RouteValueDictionary+defaults,+IRouteHandler+routeHandler)
++++++++:+base(url,+defaults,+routeHandler)
++++{

++++}

++++///+<summary>
++++///+Initializes+a+new+instance+of+the+System.Web.Routing.Route+class,+by+using
++++///+++++the+specified+URL+pattern+and+handler+class.
++++///+</summary>
++++///+<param+name="url">The+URL+pattern+for+the+route.</param>
++++///+<param+name="defaults">The+values+to+use+for+any+parameters+that+are+missing+in+the+URL.</param>
++++///+<param+name="constraints">A+regular+expression+that+specifies+valid+values+for+a+URL+parameter.</param>
++++///+<param+name="routeHandler">The+object+that+processes+requests+for+the+route.</param>
++++public+AbsoluteUrlRoute(string+url,+RouteValueDictionary+defaults,+RouteValueDictionary+constraints,
++++++++++++++++++++++++++++IRouteHandler+routeHandler)
++++++++:+base(url,+defaults,+constraints,+routeHandler)
++++{

++++}

++++///+<summary>
++++///+Initializes+a+new+instance+of+the+System.Web.Routing.Route+class,+by+using
++++///+++++the+specified+URL+pattern+and+handler+class.
++++///+</summary>
++++///+<param+name="url">The+URL+pattern+for+the+route.</param>
++++///+<param+name="defaults">The+values+to+use+for+any+parameters+that+are+missing+in+the+URL.</param>
++++///+<param+name="constraints">A+regular+expression+that+specifies+valid+values+for+a+URL+parameter.</param>
++++///+<param+name="dataTokens">Custom+values+that+are+passed+to+the+route+handler,+but+which+are+not+used
++++///+++++to+determine+whether+the+route+matches+a+specific+URL+pattern.+These+values
++++///+++++are+passed+to+the+route+handler,+where+they+can+be+used+for+processing+the
++++///+++++request.</param>
++++///+<param+name="routeHandler">The+object+that+processes+requests+for+the+route.</param>
++++public+AbsoluteUrlRoute(string+url,+RouteValueDictionary+defaults,+RouteValueDictionary+constraints,
++++++++++++++++++++++++++++RouteValueDictionary+dataTokens,+IRouteHandler+routeHandler)
++++++++:+base(url,+defaults,+constraints,+dataTokens,+routeHandler)
++++{

++++}

++++#endregion

++++public+override+VirtualPathData+GetVirtualPath(RequestContext+requestContext,+RouteValueDictionary+values)
++++{
++++++++var+virtualPath+=+base.GetVirtualPath(requestContext,+values);
++++++++if+(virtualPath+!=+null)
++++++++{
++++++++++++var+scheme+=+"http";
++++++++++++if+(this.DataTokens+!=+null+&&+(string)this.DataTokens["scheme"]+!=+string.Empty)
++++++++++++{
++++++++++++++++scheme+=+(string)+this.DataTokens["scheme"];
++++++++++++}

++++++++++++virtualPath.VirtualPath+=+MakeAbsoluteUrl(requestContext,+virtualPath.VirtualPath,+scheme);
++++++++++++return+virtualPath;
++++++++}

++++++++return+null;
++++}

++++#region+Helpers

++++///+<summary>
++++///+Creates+an+absolute+url
++++///+</summary>
++++///+<param+name="requestContext">The+request+context</param>
++++///+<param+name="virtualPath">The+initial+virtual+relative+path</param>
++++///+<param+name="scheme">The+protocol+scheme</param>
++++///+<returns>The+absolute+URL</returns>
++++private+string+MakeAbsoluteUrl(RequestContext+requestContext,+string+virtualPath,+string+scheme)
++++{
++++++++return+string.Format("{0}://{1}{2}{3}{4}",
+++++++++++++++++++++++++++++scheme,
+++++++++++++++++++++++++++++requestContext.HttpContext.Request.Url.Host,
+++++++++++++++++++++++++++++requestContext.HttpContext.Request.ApplicationPath,
+++++++++++++++++++++++++++++requestContext.HttpContext.Request.ApplicationPath.EndsWith("/")+?+""+:+"/",
+++++++++++++++++++++++++++++virtualPath);
++++}

++++#endregion
}|1518095|这个版本的"Route“类将创建绝对url。这里的技巧，以及博客文章作者的建议，是使用DataToken来指定方案(最后的示例:)。|1518096|现在，如果我们将生成一个url，例如路由"Account/LogOn“，我们将得到"/http://example.com/Account/LogOn”--这是因为UrlRoutingModule将所有url视为相对url。我们可以使用定制的HttpModule来解决这个问题：|1518097|public+class+AbsoluteUrlRoutingModule+:+UrlRoutingModule
{
++++protected+override+void+Init(System.Web.HttpApplication+application)
++++{
++++++++application.PostMapRequestHandler+%2B=+application_PostMapRequestHandler;
++++++++base.Init(application);
++++}

++++protected+void+application_PostMapRequestHandler(object+sender,+EventArgs+e)
++++{
++++++++var+wrapper+=+new+AbsoluteUrlAwareHttpContextWrapper(((HttpApplication)sender).Context);
++++}

++++public+override+void+PostResolveRequestCache(HttpContextBase+context)
++++{
++++++++base.PostResolveRequestCache(new+AbsoluteUrlAwareHttpContextWrapper(HttpContext.Current));
++++}

++++private+class+AbsoluteUrlAwareHttpContextWrapper+:+HttpContextWrapper
++++{
++++++++private+readonly+HttpContext+_context;
++++++++private+HttpResponseBase+_response+=+null;

++++++++public+AbsoluteUrlAwareHttpContextWrapper(HttpContext+context)
++++++++++++:+base(context)
++++++++{
++++++++++++this._context+=+context;
++++++++}

++++++++public+override+HttpResponseBase+Response
++++++++{
++++++++++++get
++++++++++++{
++++++++++++++++return+_response+??
+++++++++++++++++++++++(_response+=
++++++++++++++++++++++++new+AbsoluteUrlAwareHttpResponseWrapper(_context.Response));
++++++++++++}
++++++++}


++++++++private+class+AbsoluteUrlAwareHttpResponseWrapper+:+HttpResponseWrapper
++++++++{
++++++++++++public+AbsoluteUrlAwareHttpResponseWrapper(HttpResponse+response)
++++++++++++++++:+base(response)
++++++++++++{

++++++++++++}

++++++++++++public+override+string+ApplyAppPathModifier(string+virtualPath)
++++++++++++{
++++++++++++++++int+length+=+virtualPath.Length;
++++++++++++++++if+(length+>+7+&&+virtualPath.Substring(0,+7)+==+"/http:/")
++++++++++++++++++++return+virtualPath.Substring(1);
++++++++++++++++else+if+(length+>+8+&&+virtualPath.Substring(0,+8)+==+"/https:/")
++++++++++++++++++++return+virtualPath.Substring(1);

++++++++++++++++return+base.ApplyAppPathModifier(virtualPath);
++++++++++++}
++++++++}
++++}
}|1518098|由于此模块覆盖了UrlRoutingModule的基本实现，因此我们应该删除基本httpModule并在web.config中注册我们的模块。因此，在"system.web“集合下：|1518099|<httpModules>
++
++<remove+name="UrlRoutingModule-4.0"+/>
++<add+name="UrlRoutingModule-4.0"+type="MyApp.Web.Mvc.Routing.AbsoluteUrlRoutingModule"+/>
</httpModules>|1518100|就是这样:)。|1518101|要注册绝对/协议遵循的路由，应执行以下操作：|1518102|++++++++routes.Add(new+AbsoluteUrlRoute("Account/LogOn",+new+MvcRouteHandler())
++++++++++++{
++++++++++++++++Defaults+=+new+RouteValueDictionary(new+{controller+=+"Account",+action+=+"LogOn",+area+=+""}),
++++++++++++++++DataTokens+=+new+RouteValueDictionary(new+{scheme+=+"https"})
++++++++++++});|1518103|我会很乐意听到你的反馈和改进。希望它能有所帮助！:)|1518104|编辑:我忘记包含IsCurrentConnectionSecured()扩展方法(太多代码片段:P)。这是一个通常使用Request.IsSecuredConnection的扩展方法。但是，这种方法在使用负载平衡时不起作用，因此此方法可以绕过此方法(取自nopCommerce)。|1518105|++++///+<summary>
++++///+Gets+a+value+indicating+whether+current+connection+is+secured
++++///+</summary>
++++///+<param+name="request">The+base+request+context</param>
++++///+<returns>true+-+secured,+false+-+not+secured</returns>
++++///+<remarks><![CDATA[+This+method+checks+whether+or+not+the+connection+is+secured.
++++///+There's+a+standard+Request.IsSecureConnection+attribute,+but+it+won't+be+loaded+correctly+in+case+of+load-balancer.
++++///+See:+<a+href="http://nopcommerce.codeplex.com/SourceControl/changeset/view/16de4a113aa9#src/Libraries/Nop.Core/WebHelper.cs">nopCommerce+WebHelper+IsCurrentConnectionSecured()</a>]]></remarks>
++++public+static+bool+IsCurrentConnectionSecured(this+HttpRequestBase+request)
++++{
++++++++return+request+!=+null+&&+request.IsSecureConnection;

++++++++//++when+your+hosting+uses+a+load+balancer+on+their+server+then+the+Request.IsSecureConnection+is+never+got+set+to+true,+use+the+statement+below
++++++++//++just+uncomment+it
++++++++//return+request+!=+null+&&+request.ServerVariables["HTTP_CLUSTER_HTTPS"]+==+"on";
++++}|1518106|entityMap|0|LINK|mutability|MUTABLE|url|http://blog.stevensanderson.com/2008/08/05/adding-httpsssl-support-to-aspnet-mvc-routing/|1|http://example.com/Account/LogOn^0|0|0|0|0|0|0|0|0|0|0|0|10|2H|0|0|0|0|0|0|17|W|1|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|24|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|25|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|26|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|27|8|@]|9|@]|A|$]]|$1|H|3|I|5|J|7|28|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|29|8|@]|9|@]|A|$]]|$1|O|3|P|5|J|7|2A|8|@]|9|@]|A|$K|L]]|$1|Q|3|R|5|6|7|2B|8|@]|9|@]|A|$]]|$1|S|3|T|5|6|7|2C|8|@]|9|@]|A|$]]|$1|U|3|V|5|J|7|2D|8|@]|9|@]|A|$K|L]]|$1|W|3|X|5|6|7|2E|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|6|7|2F|8|@]|9|@$10|2G|11|2H|1|2I]]|A|$]]|$1|12|3|13|5|6|7|2J|8|@]|9|@]|A|$]]|$1|14|3|15|5|6|7|2K|8|@]|9|@]|A|$]]|$1|16|3|17|5|J|7|2L|8|@]|9|@]|A|$K|L]]|$1|18|3|19|5|6|7|2M|8|@]|9|@]|A|$]]|$1|1A|3|1B|5|6|7|2N|8|@]|9|@$10|2O|11|2P|1|2Q]]|A|$]]|$1|1C|3|1D|5|J|7|2R|8|@]|9|@]|A|$K|L]]|$1|1E|3|1F|5|6|7|2S|8|@]|9|@]|A|$]]|$1|1G|3|1H|5|J|7|2T|8|@]|9|@]|A|$K|L]]|$1|1I|3|1J|5|6|7|2U|8|@]|9|@]|A|$]]|$1|1K|3|1L|5|6|7|2V|8|@]|9|@]|A|$]]|$1|1M|3|1N|5|J|7|2W|8|@]|9|@]|A|$K|L]]|$1|1O|3|1P|5|6|7|2X|8|@]|9|@]|A|$]]|$1|1Q|3|1R|5|6|7|2Y|8|@]|9|@]|A|$]]|$1|1S|3|1T|5|J|7|2Z|8|@]|9|@]|A|$K|L]]|$1|1U|3|-4|5|6|7|30|8|@]|9|@]|A|$]]]|1V|$1W|$5|1X|1Y|1Z|A|$20|21]]|22|$5|1X|1Y|1Z|A|$20|23]]]]

I went accross this question and hope my solution can helps someone.

We got few problems:
 - We need to secure specific actions, for instance "LogOn" in "Account". We can use the build in RequireHttps attribute, which is great - but it'll redirect us back with https://.
 - We should make our links, forms and such "SSL aware".

Generally, my solution allows to specify routes that will use absolute url, in addition to the ability to specify the protocol. You can use this approch to specify the "https" protocol.

So, firstly I've created an ConnectionProtocol enum:

<pre><code>/// &lt;summary&gt;
/// Enum representing the available secure connection requirements
/// &lt;/summary&gt;
public enum ConnectionProtocol
{
 /// &lt;summary&gt;
 /// No secure connection requirement
 /// &lt;/summary&gt;
 Ignore,

 /// &lt;summary&gt;
 /// No secure connection should be used, use standard http request.
 /// &lt;/summary&gt;
 Http,

 /// &lt;summary&gt;
 /// The connection should be secured using SSL (https protocol).
 /// &lt;/summary&gt;
 Https
}
</code></pre>

Now, I've created hand-rolled version of RequireSsl. I've modified the original RequireSsl source code to allow redirection back to http:// urls. In addition, I've put a field that allows us to determine if we should require SSL or not (I'm using it with the DEBUG pre-processor).

<pre><code>/* Note:
 * This is hand-rolled version of the original System.Web.Mvc.RequireHttpsAttribute.
 * This version contains three improvements:
 * - Allows to redirect back into http:// addresses, based on the &lt;see cref="SecureConnectionRequirement" /&gt; Requirement property.
 * - Allows to turn the protocol scheme redirection off based on given condition.
 * - Using Request.IsCurrentConnectionSecured() extension method, which contains fix for load-balanced servers.
 */
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false)]
public sealed class RequireHttpsAttribute : FilterAttribute, IAuthorizationFilter
{
 public RequireHttpsAttribute()
 {
 Protocol = ConnectionProtocol.Ignore;
 }

 /// &lt;summary&gt;
 /// Gets or sets the secure connection required protocol scheme level
 /// &lt;/summary&gt;
 public ConnectionProtocol Protocol { get; set; }

 /// &lt;summary&gt;
 /// Gets the value that indicates if secure connections are been allowed
 /// &lt;/summary&gt;
 public bool SecureConnectionsAllowed
 {
 get
 {
#if DEBUG
 return false;
#else
 return true;
#endif
 }
 }

 public void OnAuthorization(System.Web.Mvc.AuthorizationContext filterContext)
 {
 if (filterContext == null)
 {
 throw new ArgumentNullException("filterContext");
 }

 /* Are we allowed to use secure connections? */
 if (!SecureConnectionsAllowed)
 return;

 switch (Protocol)
 {
 case ConnectionProtocol.Https:
 if (!filterContext.HttpContext.Request.IsCurrentConnectionSecured())
 {
 HandleNonHttpsRequest(filterContext);
 }
 break;
 case ConnectionProtocol.Http:
 if (filterContext.HttpContext.Request.IsCurrentConnectionSecured())
 {
 HandleNonHttpRequest(filterContext);
 }
 break;
 }
 }


 private void HandleNonHttpsRequest(AuthorizationContext filterContext)
 {
 // only redirect for GET requests, otherwise the browser might not propagate the verb and request
 // body correctly.

 if (!String.Equals(filterContext.HttpContext.Request.HttpMethod, "GET", StringComparison.OrdinalIgnoreCase))
 {
 throw new InvalidOperationException("The requested resource can only be accessed via SSL.");
 }

 // redirect to HTTPS version of page
 string url = "https://" + filterContext.HttpContext.Request.Url.Host + filterContext.HttpContext.Request.RawUrl;
 filterContext.Result = new RedirectResult(url);
 }

 private void HandleNonHttpRequest(AuthorizationContext filterContext)
 {
 if (!String.Equals(filterContext.HttpContext.Request.HttpMethod, "GET", StringComparison.OrdinalIgnoreCase))
 {
 throw new InvalidOperationException("The requested resource can only be accessed without SSL.");
 }

 // redirect to HTTP version of page
 string url = "http://" + filterContext.HttpContext.Request.Url.Host + filterContext.HttpContext.Request.RawUrl;
 filterContext.Result = new RedirectResult(url);
 }
}
</code></pre>

Now, this RequireSsl will do the following base on your Requirements attribute value:
 - Ignore: Won't do nothing.
 - Http: Will force redirection to http protocol.
 - Https: Will force redirection to https protocol.

You should create your own base controller and set this attribute to Http.

<pre><code>[RequireSsl(Requirement = ConnectionProtocol.Http)]
public class MyController : Controller
{
 public MyController() { }
}
</code></pre>

Now, in each cpntroller/action you'd like to require SSL - just set this attribute with ConnectionProtocol.Https.

Now lets move to URLs: We got few problems with the url routing engine. You can read more about them at <a href="http://blog.stevensanderson.com/2008/08/05/adding-httpsssl-support-to-aspnet-mvc-routing/" rel="nofollow">http://blog.stevensanderson.com/2008/08/05/adding-httpsssl-support-to-aspnet-mvc-routing/</a>. The solution suggested in this post is theoreticly good, but old and I don't like the approch.

My solutions is the following:
Create a subclass of the basic "Route" class:

public class AbsoluteUrlRoute : Route
 {
 #region ctor

<pre><code> /// &lt;summary&gt;
 /// Initializes a new instance of the System.Web.Routing.Route class, by using
 /// the specified URL pattern and handler class.
 /// &lt;/summary&gt;
 /// &lt;param name="url"&gt;The URL pattern for the route.&lt;/param&gt;
 /// &lt;param name="routeHandler"&gt;The object that processes requests for the route.&lt;/param&gt;
 public AbsoluteUrlRoute(string url, IRouteHandler routeHandler)
 : base(url, routeHandler)
 {

 }

 /// &lt;summary&gt;
 /// Initializes a new instance of the System.Web.Routing.Route class, by using
 /// the specified URL pattern and handler class.
 /// &lt;/summary&gt;
 /// &lt;param name="url"&gt;The URL pattern for the route.&lt;/param&gt;
 /// &lt;param name="defaults"&gt;The values to use for any parameters that are missing in the URL.&lt;/param&gt;
 /// &lt;param name="routeHandler"&gt;The object that processes requests for the route.&lt;/param&gt;
 public AbsoluteUrlRoute(string url, RouteValueDictionary defaults, IRouteHandler routeHandler)
 : base(url, defaults, routeHandler)
 {

 }

 /// &lt;summary&gt;
 /// Initializes a new instance of the System.Web.Routing.Route class, by using
 /// the specified URL pattern and handler class.
 /// &lt;/summary&gt;
 /// &lt;param name="url"&gt;The URL pattern for the route.&lt;/param&gt;
 /// &lt;param name="defaults"&gt;The values to use for any parameters that are missing in the URL.&lt;/param&gt;
 /// &lt;param name="constraints"&gt;A regular expression that specifies valid values for a URL parameter.&lt;/param&gt;
 /// &lt;param name="routeHandler"&gt;The object that processes requests for the route.&lt;/param&gt;
 public AbsoluteUrlRoute(string url, RouteValueDictionary defaults, RouteValueDictionary constraints,
 IRouteHandler routeHandler)
 : base(url, defaults, constraints, routeHandler)
 {

 }

 /// &lt;summary&gt;
 /// Initializes a new instance of the System.Web.Routing.Route class, by using
 /// the specified URL pattern and handler class.
 /// &lt;/summary&gt;
 /// &lt;param name="url"&gt;The URL pattern for the route.&lt;/param&gt;
 /// &lt;param name="defaults"&gt;The values to use for any parameters that are missing in the URL.&lt;/param&gt;
 /// &lt;param name="constraints"&gt;A regular expression that specifies valid values for a URL parameter.&lt;/param&gt;
 /// &lt;param name="dataTokens"&gt;Custom values that are passed to the route handler, but which are not used
 /// to determine whether the route matches a specific URL pattern. These values
 /// are passed to the route handler, where they can be used for processing the
 /// request.&lt;/param&gt;
 /// &lt;param name="routeHandler"&gt;The object that processes requests for the route.&lt;/param&gt;
 public AbsoluteUrlRoute(string url, RouteValueDictionary defaults, RouteValueDictionary constraints,
 RouteValueDictionary dataTokens, IRouteHandler routeHandler)
 : base(url, defaults, constraints, dataTokens, routeHandler)
 {

 }

 #endregion

 public override VirtualPathData GetVirtualPath(RequestContext requestContext, RouteValueDictionary values)
 {
 var virtualPath = base.GetVirtualPath(requestContext, values);
 if (virtualPath != null)
 {
 var scheme = "http";
 if (this.DataTokens != null &amp;&amp; (string)this.DataTokens["scheme"] != string.Empty)
 {
 scheme = (string) this.DataTokens["scheme"];
 }

 virtualPath.VirtualPath = MakeAbsoluteUrl(requestContext, virtualPath.VirtualPath, scheme);
 return virtualPath;
 }

 return null;
 }

 #region Helpers

 /// &lt;summary&gt;
 /// Creates an absolute url
 /// &lt;/summary&gt;
 /// &lt;param name="requestContext"&gt;The request context&lt;/param&gt;
 /// &lt;param name="virtualPath"&gt;The initial virtual relative path&lt;/param&gt;
 /// &lt;param name="scheme"&gt;The protocol scheme&lt;/param&gt;
 /// &lt;returns&gt;The absolute URL&lt;/returns&gt;
 private string MakeAbsoluteUrl(RequestContext requestContext, string virtualPath, string scheme)
 {
 return string.Format("{0}://{1}{2}{3}{4}",
 scheme,
 requestContext.HttpContext.Request.Url.Host,
 requestContext.HttpContext.Request.ApplicationPath,
 requestContext.HttpContext.Request.ApplicationPath.EndsWith("/") ? "" : "/",
 virtualPath);
 }

 #endregion
}
</code></pre>

This version of "Route" class will create absolute url. The trick here, followed by the blog post author suggestion, is to use the DataToken to specify the scheme (example at the end :) ).

Now, if we'll generate an url, for example for the route "Account/LogOn" we'll get "/<a href="http://example.com/Account/LogOn" rel="nofollow">http://example.com/Account/LogOn</a>" - that's since the UrlRoutingModule sees all the urls as relative. We can fix that using custom HttpModule:

<pre><code>public class AbsoluteUrlRoutingModule : UrlRoutingModule
{
 protected override void Init(System.Web.HttpApplication application)
 {
 application.PostMapRequestHandler += application_PostMapRequestHandler;
 base.Init(application);
 }

 protected void application_PostMapRequestHandler(object sender, EventArgs e)
 {
 var wrapper = new AbsoluteUrlAwareHttpContextWrapper(((HttpApplication)sender).Context);
 }

 public override void PostResolveRequestCache(HttpContextBase context)
 {
 base.PostResolveRequestCache(new AbsoluteUrlAwareHttpContextWrapper(HttpContext.Current));
 }

 private class AbsoluteUrlAwareHttpContextWrapper : HttpContextWrapper
 {
 private readonly HttpContext _context;
 private HttpResponseBase _response = null;

 public AbsoluteUrlAwareHttpContextWrapper(HttpContext context)
 : base(context)
 {
 this._context = context;
 }

 public override HttpResponseBase Response
 {
 get
 {
 return _response ??
 (_response =
 new AbsoluteUrlAwareHttpResponseWrapper(_context.Response));
 }
 }


 private class AbsoluteUrlAwareHttpResponseWrapper : HttpResponseWrapper
 {
 public AbsoluteUrlAwareHttpResponseWrapper(HttpResponse response)
 : base(response)
 {

 }

 public override string ApplyAppPathModifier(string virtualPath)
 {
 int length = virtualPath.Length;
 if (length &gt; 7 &amp;&amp; virtualPath.Substring(0, 7) == "/http:/")
 return virtualPath.Substring(1);
 else if (length &gt; 8 &amp;&amp; virtualPath.Substring(0, 8) == "/https:/")
 return virtualPath.Substring(1);

 return base.ApplyAppPathModifier(virtualPath);
 }
 }
 }
}
</code></pre>

Since this module is overriding the base implementation of UrlRoutingModule, we should remove the base httpModule and register ours in web.config. So, under "system.web" set: 

<pre><code>&lt;httpModules&gt;
 &lt;!-- Removing the default UrlRoutingModule and inserting our own absolute url routing module --&gt;
 &lt;remove name="UrlRoutingModule-4.0" /&gt;
 &lt;add name="UrlRoutingModule-4.0" type="MyApp.Web.Mvc.Routing.AbsoluteUrlRoutingModule" /&gt;
&lt;/httpModules&gt;
</code></pre>

Thats it :).

In order to register an absolute / protocol followed route, you should do:

<pre><code> routes.Add(new AbsoluteUrlRoute("Account/LogOn", new MvcRouteHandler())
 {
 Defaults = new RouteValueDictionary(new {controller = "Account", action = "LogOn", area = ""}),
 DataTokens = new RouteValueDictionary(new {scheme = "https"})
 });
</code></pre>

Will love to hear your feedback + improvements. Hope it can help! :)

Edit:
I forgot to include the IsCurrentConnectionSecured() extension method (too many snippets :P). This is an extension method that generally uses Request.IsSecuredConnection. However, this approch will not work when using load-balancing - so this method can bypass this (took from nopCommerce).

<pre><code> /// &lt;summary&gt;
 /// Gets a value indicating whether current connection is secured
 /// &lt;/summary&gt;
 /// &lt;param name="request"&gt;The base request context&lt;/param&gt;
 /// &lt;returns&gt;true - secured, false - not secured&lt;/returns&gt;
 /// &lt;remarks&gt;&lt;![CDATA[ This method checks whether or not the connection is secured.
 /// There's a standard Request.IsSecureConnection attribute, but it won't be loaded correctly in case of load-balancer.
 /// See: &lt;a href="http://nopcommerce.codeplex.com/SourceControl/changeset/view/16de4a113aa9#src/Libraries/Nop.Core/WebHelper.cs"&gt;nopCommerce WebHelper IsCurrentConnectionSecured()&lt;/a&gt;]]&gt;&lt;/remarks&gt;
 public static bool IsCurrentConnectionSecured(this HttpRequestBase request)
 {
 return request != null &amp;&amp; request.IsSecureConnection;

 // when your hosting uses a load balancer on their server then the Request.IsSecureConnection is never got set to true, use the statement below
 // just uncomment it
 //return request != null &amp;&amp; request.ServerVariables["HTTP_CLUSTER_HTTPS"] == "on";
 }
</code></pre>

blocks|key|1732669|text|这是2009年1月的blog+post+by+Pablo+M.+Cibrano，它汇集了几种技术，包括HttpModule和扩展方法。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1732670|entityMap|0|LINK|mutability|MUTABLE|url|http://weblogs.asp.net/cibrax/archive/2009/01/19/running-a-partial-ssl-website-in-asp-net-mvc.aspx^0|A|T|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Here's a <a href="http://weblogs.asp.net/cibrax/archive/2009/01/19/running-a-partial-ssl-website-in-asp-net-mvc.aspx" rel="nofollow noreferrer">blog post by Pablo M. Cibrano</a> from January 2009 that gathers up a couple of techniques including a HttpModule and extension methods.

blocks|key|1732706|text|这是一个使用ActionFilter的blog+post+by+Adam+Salvo。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1732707|entityMap|0|LINK|mutability|MUTABLE|url|http://blog.salvoz.com/2009/03/14/PartialSSLAndAuthorizationWithAspNetMVC.aspx^0|J|N|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Here's a <a href="http://blog.salvoz.com/2009/03/14/PartialSSLAndAuthorizationWithAspNetMVC.aspx" rel="nofollow noreferrer">blog post by Adam Salvo</a> that uses an ActionFilter.

blocks|key|1517920|text|这不一定是特定于MVC的，但是这个解决方案确实适用于ASP.NET+WebForms和MVC：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1517921|http://www.codeproject.com/KB/web-security/WebPageSecurity_v2.aspx|offset|length|1517922|我已经使用这个工具好几年了，喜欢通过web.config文件实现关注点和管理的分离。|1517923|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|1U|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@$D|Q|E|R|1|S]]|A|$]]|$1|F|3|G|5|6|7|T|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|U|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|C]]]]

This isn't necessarily MVC specific, but this solution does work for both ASP.NET WebForms and MVC:

<a href="http://www.codeproject.com/KB/web-security/WebPageSecurity_v2.aspx" rel="nofollow noreferrer">http://www.codeproject.com/KB/web-security/WebPageSecurity_v2.aspx</a>

I've used this for several years and like the separation of concerns and management via the web.config file.

How do I go about using HTTPS for some of the pages in my ASP.NET MVC based site?

Steve Sanderson has a pretty good tutorial on how to do this in a DRY way on Preview 4 at:

<a href="http://blog.codeville.net/2008/08/05/adding-httpsssl-support-to-aspnet-mvc-routing/" rel="noreferrer">http://blog.codeville.net/2008/08/05/adding-httpsssl-support-to-aspnet-mvc-routing/</a>

Is there a better / updated way with Preview 5?,

SSL pages under ASP.NET MVC

路由

如何在基于ASP.NET MVC的站点中的一些页面上使用HTTPS？Steve Sanderson在Preview 4上有一个很好的教程，关于如何以一种干燥的方式做到这一点，请访问：Preview 5有没有更好的/更新的方式？

问ASP.NET MVC下的SSL页面
EN

回答 9

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问ASP.NET MVC下的SSL页面EN

回答 9

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问ASP.NET MVC下的SSL页面
EN