| Groups | Blog | Home |
dotnet security : How to make SSL work for .NET 2.0 web apps
server, but I'm not sure how to force IIS to use SSL on my deployed web app residing on that server? Any hints? what I currently have is www.myDomain.com works but issues a security warning from IE but my site still functions as normal. https://www.myDomain.com also works and I see the secure lock icon in IE (with no prompt this time). I think what I want is that www.myDomain.com will automatically get redirected to https:// - Am I missing something obvious? How do I get my web app to know that only the directories below my root should be SSL? I realize my forms authentication will prevent login access, but how do tell my IIS web server that .aspx pages in this dir are SSL? Basic questions I know, any help is appreciated -- I've not configured SSL web server before. Thanks, Rob.
Nicole,
Excellent link/info, thank you. Rob. [quoted text, click to view] "Nicole Calinoiu" <calinoiu REMOVETHIS AT gmail DOT com> wrote in message news:ujvyNTkhGHA.764@TK2MSFTNGP03.phx.gbl... > You might want to start by reading > http://weblogs.asp.net/pwilson/archive/2004/12/23/331455.aspx then posting > back here if you have any remaining questions. > > > > "Rob R. Ainscough" <robains@pacbell.net> wrote in message > news:Oct6OxehGHA.3496@TK2MSFTNGP04.phx.gbl... >> I've successfully installed my Verising SSL pro certification on my web >> server, but I'm not sure how to force IIS to use SSL on my deployed web >> app residing on that server? >> >> Any hints? >> >> what I currently have is www.myDomain.com works but issues a security >> warning from IE but my site still functions as normal. >> https://www.myDomain.com also works and I see the secure lock icon in IE >> (with no prompt this time). I think what I want is that www.myDomain.com >> will automatically get redirected to https:// - Am I missing something >> obvious? >> >> How do I get my web app to know that only the directories below my root >> should be SSL? I realize my forms authentication will prevent login >> access, but how do tell my IIS web server that .aspx pages in this dir >> are SSL? >> >> Basic questions I know, any help is appreciated -- I've not configured >> SSL web server before. >> >> Thanks, Rob. >> > >
A couple of issues I'm having:
I'm only enabling SSL for a "Secure" directory under my web app's root directory - not the entire web site. I use forms authentication for ~/Secure/Logon.aspx - my logon page and this resides in my SSL enabled directory. My web site redirects a frame to display the ~/Secure/Logon.aspx. I added a /NotSecure/SSLRedirect.aspx and setup IIS to use this page for 403;4 custom error only for my Secure directory. I also added the Location path entry in my web.config for the SSLRedirect.aspx and also authorization setting. However, when I navigate to the www.mywebsite.com I get "You are not authorized to view this page" in the frame that should be displaying my ~/Secure/Logon.aspx. Since I am using forms authentication (on my Secure directory), I'm assuming that multiple Location entries in my web.config is Ok? Any hints on how to make SSL work on part of web site (my Secure directory) using forms authentication and not for the entire web site? thanks, Rob. [quoted text, click to view] "Nicole Calinoiu" <calinoiu REMOVETHIS AT gmail DOT com> wrote in message news:ujvyNTkhGHA.764@TK2MSFTNGP03.phx.gbl... > You might want to start by reading > http://weblogs.asp.net/pwilson/archive/2004/12/23/331455.aspx then posting > back here if you have any remaining questions. > > > > "Rob R. Ainscough" <robains@pacbell.net> wrote in message > news:Oct6OxehGHA.3496@TK2MSFTNGP04.phx.gbl... >> I've successfully installed my Verising SSL pro certification on my web >> server, but I'm not sure how to force IIS to use SSL on my deployed web >> app residing on that server? >> >> Any hints? >> >> what I currently have is www.myDomain.com works but issues a security >> warning from IE but my site still functions as normal. >> https://www.myDomain.com also works and I see the secure lock icon in IE >> (with no prompt this time). I think what I want is that www.myDomain.com >> will automatically get redirected to https:// - Am I missing something >> obvious? >> >> How do I get my web app to know that only the directories below my root >> should be SSL? I realize my forms authentication will prevent login >> access, but how do tell my IIS web server that .aspx pages in this dir >> are SSL? >> >> Basic questions I know, any help is appreciated -- I've not configured >> SSL web server before. >> >> Thanks, Rob. >> > >
You might want to start by reading
http://weblogs.asp.net/pwilson/archive/2004/12/23/331455.aspx then posting back here if you have any remaining questions. [quoted text, click to view] "Rob R. Ainscough" <robains@pacbell.net> wrote in message news:Oct6OxehGHA.3496@TK2MSFTNGP04.phx.gbl... > I've successfully installed my Verising SSL pro certification on my web > server, but I'm not sure how to force IIS to use SSL on my deployed web > app residing on that server? > > Any hints? > > what I currently have is www.myDomain.com works but issues a security > warning from IE but my site still functions as normal. > https://www.myDomain.com also works and I see the secure lock icon in IE > (with no prompt this time). I think what I want is that www.myDomain.com > will automatically get redirected to https:// - Am I missing something > obvious? > > How do I get my web app to know that only the directories below my root > should be SSL? I realize my forms authentication will prevent login > access, but how do tell my IIS web server that .aspx pages in this dir are > SSL? > > Basic questions I know, any help is appreciated -- I've not configured SSL > web server before. > > Thanks, Rob. >
[quoted text, click to view]
"Rob R. Ainscough" <robains@pacbell.net> wrote in message news:O15ByulhGHA.4896@TK2MSFTNGP05.phx.gbl... <snip>> > My web site redirects a frame to display the ~/Secure/Logon.aspx. I added > a /NotSecure/SSLRedirect.aspx Have you tested that the redirection is actually working correctly? [quoted text, click to view] > and setup IIS to use this page for 403;4 custom error only for my Secure > directory. I also added the Location path entry in my web.config for the > SSLRedirect.aspx and also authorization setting. Have you tested that the authorization exception is working correctly? i.e.: Can you successfully navigate to the page without logging in? [quoted text, click to view] > However, when I navigate to the www.mywebsite.com I get "You are not > authorized to view this page" in the frame that should be displaying my > ~/Secure/Logon.aspx. What is the frame src value? [quoted text, click to view] > Since I am using forms authentication (on my Secure directory), I'm > assuming that multiple Location entries in my web.config is Ok? It should be. BTW, you should also be testing that an attempt to view any of your "secured" pages directly without logging also results in the desired redirection to the login page. [quoted text, click to view] > Any hints on how to make SSL work on part of web site (my Secure > directory) using forms authentication and not for the entire web site? > > thanks, Rob. > > > "Nicole Calinoiu" <calinoiu REMOVETHIS AT gmail DOT com> wrote in message > news:ujvyNTkhGHA.764@TK2MSFTNGP03.phx.gbl... >> You might want to start by reading >> http://weblogs.asp.net/pwilson/archive/2004/12/23/331455.aspx then >> posting back here if you have any remaining questions. >> >> >> >> "Rob R. Ainscough" <robains@pacbell.net> wrote in message >> news:Oct6OxehGHA.3496@TK2MSFTNGP04.phx.gbl... >>> I've successfully installed my Verising SSL pro certification on my web >>> server, but I'm not sure how to force IIS to use SSL on my deployed web >>> app residing on that server? >>> >>> Any hints? >>> >>> what I currently have is www.myDomain.com works but issues a security >>> warning from IE but my site still functions as normal. >>> https://www.myDomain.com also works and I see the secure lock icon in IE >>> (with no prompt this time). I think what I want is that >>> www.myDomain.com will automatically get redirected to https:// - Am I >>> missing something obvious? >>> >>> How do I get my web app to know that only the directories below my root >>> should be SSL? I realize my forms authentication will prevent login >>> access, but how do tell my IIS web server that .aspx pages in this dir >>> are SSL? >>> >>> Basic questions I know, any help is appreciated -- I've not configured >>> SSL web server before. >>> >>> Thanks, Rob. >>> >> >> > >
Don't see what you're looking for? Try a search.
|
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
| home · blog · groups | Questions? Comments? Contact the dn |