What is the easiest way to force users to HTTPS

[lgrupido]

I have a server that needs to run HTTPS.

But if a user forgets and tries going to http instead, how can I make sure they auto-forward to HTTPS instead of getting a server not found error?

Can I do that outside of Alpha Server, like right at the domain or something?

[Steve Wood]

Re: What is the easiest way to force users to HTTPS

1) you can set up a second Alpha instance listening to port 80 and then have an index.a5w page with the following:
response.redirect("https://mydomain.com")

2) you can use IIS to listen to port 80 and also set up a redirect using their standard method.

3) you can use my new load balancer with a node set to listen on port 80 and use the balancer's configuration to redirect to port 443

4) with item 1 above, you can also use Meta Tags to redirect, Google that.

[lgrupido]

Re: What is the easiest way to force users to HTTPS

The reason I am asking:

I have used Alpha for that purpose before, but in order to do so, you need to check if you are in HTTP instead of HTTPS before redirecting.

The only way I know how to do that is:

if Request.Protocol = "Http" then

response.redirect()

end if

But when I try to check the request variables I get a 500 Error. This server is running an older version of Alpha V12 - never versions won't work with some of the components in it.

So I can't use Alpha unless I can find a way to check the HTTP status with using Request.variables.

And I have never used IIS before, but I guess I can look up how to make this one particular setting.

I was hoping there was some setting I could place at the domain level - like in the A record or something.

Thanks for the advice.

If all else fails, I'll be back to check out your load balancer!

[Steve Wood]

Re: What is the easiest way to force users to HTTPS

That doesn't make sense. You cannot "check" if they are using http or https, those requests come in on different ports. And even if you can do something like that, your visitor's browser is going to complain that the site is not secure; but I don't thi k it is possible anyway. I have never seen where a DNS record can fix this. IIS is the easy route and I will detail when home.

[Davidk]

Re: What is the easiest way to force users to HTTPS

Isn't this something your hosting provider can look after?

[lgrupido]

Re: What is the easiest way to force users to HTTPS

Lookup request.protocol in the help files.

Or use

? request.protocol

in an a5w page. It works great.

So:

if request.protocol = "http" then
response.redirect("https://mywebpage")
end if

Will send you to HTTPS if you are in HTTP.

The browser won't be there long enough to complain.

[Steve Wood]

Re: What is the easiest way to force users to HTTPS

OK, unless I am missing something you still have to have two Alpha Instances, one listening on port 80, one on port 443.

[lgrupido]

Re: What is the easiest way to force users to HTTPS

Yes, that is true.

[lgrupido]

Re: What is the easiest way to force users to HTTPS

Setting up IIS to do the port forward was super easy. Wish I had tried it in the past!