Server.transfer and ssl

[Gigino]

I'm developing an asp.net application and i need to execute an aspx
page using Secure Socket Layer; the problem is:
i call the page web form http://server/page1.aspx; when i submit this
form, i wanted to use the server.transfer to go to
httpS://server/page2.aspx with ssl, but the Transfer method doesn't
allow absolute path. Is there a way to do something like that or need
i to call with https all my pages?
thank you for any help
Pietro

 

[Chad Z. Hower aka Kudzu]

(e-mail address removed) (Gigino) wrote in

page using Secure Socket Layer; the problem is:
i call the page web form http://server/page1.aspx; when i submit this
form, i wanted to use the server.transfer to go to
httpS://server/page2.aspx with ssl, but the Transfer method doesn't
allow absolute path. Is there a way to do something like that or need
i to call with https all my pages?

Why not just have the user start at https://server/page1.aspx?

 

[Eric Lawrence [MSFT]]

What data are you trying to protect? There's no point in doing a
Server.Transfer if the user has already uploaded their sensitive data to the
plain HTTP site. Use a Response.redirect instead, or make the post go to
the SSL page directly.

--
Thanks,

Eric Lawrence
Program Manager
Assistance and Worldwide Services

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Gigino]

I need to protect only few pages, not all... so i wanted to use ssl
only when needed for performance reasons.

 

[Kevin Spencer]

It is the "https" in the url that instructs the server to use SSL, and the
"http" in the url that tells the server to switch back to non-SSL. It is the
browser request that initialtes the switch. Using Server.Transfer doesn't
give the browser the opportunity to specify a protocol. Even in a secured
page, if the links on the client are relative, the browser simply appends
the protocol and domain information (from the current page request) to the
relative pathe in its request, so that links in a client-side page that
change the protocol must be absolute, including the protocol. You may want
to try Response.Redirect, which passes a url to the browser, instructing to
make a fresh request for that url.

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
Big things are made up
of lots of little things.