Solved

Using Login In  on Default page Http/Https

Posted on 2010-08-26
4
378 Views
Last Modified: 2012-06-27
My website Introduces users to site via a default pages (http://domainName/Default.aspx) contained on page is user Login Control.  Upon user authentication user is transfer to a role driven admin page or a member page (https://domainName/siteName/RoleDrivenPage.aspx).  My problem is everyone needs access to see Default page because there are links to non-secure areas.  I cannot set 'requireSSL= true' because default page resides on 'http', and when I set 'requireSSL=false' user logs in and then require to login again using https://domainName/siteName/Default.aspx.  

Is there a way to use this Default/Login functionality?
Web.config:

 <!--
            The <authentication> section enables configuration 
            of the security authentication mode used by 
            ASP.NET to identify an incoming user. 
        -->
    <authentication mode="Forms">
      <forms protection="All" name=".ASPXFORMSAUTH" loginUrl="Default.aspx" slidingExpiration="false"  timeout="10" requireSSL="true"
        cookieless="UseCookies" />
    </authentication>
    <!-- This section denies access to all files in this application except for those that you have not explicitly specified by using another setting. -->
    <authorization>
      <deny users="?" />
    </authorization>
    <httpCookies requireSSL="true" />
    <!--Memeber ship Class -->
    <membership defaultProvider="SqlProvider" userIsOnlineTimeWindow="15">
      <providers>
        <remove name="AspNetSqlProvider" />
        <add name="SqlProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="rmeaspnetdbConnectionString" applicationName="/" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" passwordFormat="Hashed"/>
      </providers>
    </membership>
    <!--Role Management goes here-->
    <roleManager defaultProvider="SqlProvider" enabled="true" cacheRolesInCookie="true" cookieProtection="All">
      <providers>
        <add name="SqlProvider" type="System.Web.Security.SqlRoleProvider" connectionStringName="rmeaspnetdbConnectionString"
             applicationName="/" />
      </providers>
    </roleManager>
  </system.web> <!-- Closing System.web inorder to apply location tags -->

  <!-- This section gives the unauthenticated user access to the Default1.aspx page only. It is located in the same folder as this configuration file. -->
  <location path="Default.aspx">
    <system.web>
      <authorization>
        <allow users ="*" />
      </authorization>
    </system.web>
  </location>
  <!-- This section gives the authenticated user access to all of the files that are stored in the Member Content Pages folder.  -->
  <location path="MemberContentPages">
    <system.web>
      <authorization>
        <deny users ="?" />
        <allow users = "*" />
      </authorization>
    </system.web>
  </location>
  <!-- This section gives the authenticated user with Role Administrator, Site Admin and Assistant access to all of the files that are stored in the Entity Content Pages folder.  -->
  <location path="EntityContentPages">
    <system.web>
      <authorization>
        <deny users ="?" />
        <deny roles = "Member" />
        <deny roles = "Client" />
      </authorization>
    </system.web>
  </location>

Open in new window

0
Comment
Question by:Robert Treadwell
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 28

Expert Comment

by:strickdd
ID: 33541213
As long as you aren't pulling content from sources via "http" you can have offsite links to "http" from an "https" page. Things to watch are mainly images and CSS files. If you can, switch these to be relative links (e.g., "/MySite/Style.css" instead of "http://mysite.com/MySite/Style.css").

The other option would be to create a separate login page.
0
 
LVL 51

Assisted Solution

by:Steve Bink
Steve Bink earned 500 total points
ID: 33548088
Why not make the default page for http forward to https instead?  
0
 

Author Comment

by:Robert Treadwell
ID: 33549802
I thought of that and will do it at last resort.  However I was reading documentation on Login over HTTPS from HTTP, are you aware 'routinet'  how to do this and do you happen to know where I may be able to find an example of this functionality.
0
 
LVL 51

Accepted Solution

by:
Steve Bink earned 500 total points
ID: 33550121
>>> I thought of that and will do it at last resort.

I don't see why it should be a last resort.  I have never seen the use in having a non-SSL portion of your site if you already have the SSL certificate to secure it.

>>> Login over HTTPS from HTTP

The HTTP or HTTPS describes the structure and flow between a client and a server.  If I request a page from your server using HTTP, the response is sent in plain text.  If that page has a link or a form to an HTTPS page, and I click it or submit the form, my client will initiate an SSL conversation with your server, and my subsequent request and your response will be sent as encrypted content.  For a link, that takes the form of:

<a href="https://yourserver.com/page.php">

For a form:

<form name="myform" action="https://yourserver.com/formhandler.php" method="post">

The main thing you need to be aware of when switching to SSL is that other resources need to come from an SSL source also.  Otherwise, the user receives a mixed-content warning.  You can easily account for this behavior by using relative links in your resources.  For example, instead of:

<img src="http://yourserver.com/images/image.jpg" />

Use this:

<img src="/images/image.jpg" />

The requests generated by the second example will automagically add the protocol and server name, since it is implied to be the same server and protocol as the original request.
0

Featured Post

Salesforce Made Easy to Use

On-screen guidance at the moment of need enables you & your employees to focus on the core, you can now boost your adoption rates swiftly and simply with one easy tool.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction ( All good things must come to an end ) The original MySQL API has gone away.  It was deprecated (years ago) by PHP in Version 5.5, and removed from PHP in all current releases .  As a result, the issue is upon us today.  It's time to …
It’s a strangely common occurrence that when you send someone their login details for a system, they can’t get in. This article will help you understand why it happens, and what you can do about it.
This video teaches viewers how to create their own website using cPanel and Wordpress. Tutorial walks users through how to set up their own domain name from tools like Domain Registrar, Hosting Account, and Wordpress. More specifically, the order in…
Learn how to set-up custom confirmation messages to users who complete your Wufoo form. Include inputs from fields in your form, webpage redirects, and more with Wufoo’s confirmation options.

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question