Re: ASP.NET and SSL question

Hi Eliyahu,
Thanks for the reply. I will test this out but I'm not at that stage, I'm trying to get a heads up and work out the best way to approach this.

I've seen websites where you login under http you are then redirected to a https page for authentication and then you can access the rest of the web site under http for example www.king.com. I'm wondering if I could do something similar in ASP.NET.

Cheers
Steve
"Eliyahu Goldin" <REMOVEALLCAPITALSeEgGoldDinN@xxxxxxxxxxxx> wrote in message news:OPzAaZqUIHA.4532@xxxxxxxxxxxxxxxxxxxxxxx
My understanding is that the scope of using SSL is one http request. So if you navigate from the home page to other pages with https://..., you will use SSL. If you do with http, you won't.

I am not sure though if you will remain in the same application as you switch from http to https. Give it a try and see if the user remains authenticated.

--
Eliyahu Goldin,
Software Developer
Microsoft MVP [ASP.NET]
http://msmvps.com/blogs/egoldin
http://usableasp.net


"Steve S" <steven.stewart@xxxxxxxxxxxxx> wrote in message news:9D1D406B-6731-4908-9B55-1758BD956487@xxxxxxxxxxxxxxxx
Hi,
I have an ASP.NET 2.0 application with an ASP.NET login control in the master page. The user can only access the home page without logging in, all the other pages require authentication. Once the user has logged in the login control is hidden.

To secure the users name and password does this mean my entire web site should use SSL or can I get away with just using SSL on the home page where they login?

Please feel free to ask for more information.
Thanks
Steve








.

Relevant Pages

  • Re: Forms Authentication with http/https
    ... If you still want to switch to http (althought I would not recomend you ... > FormsAuthentication.RedirectFromLoginPage methods redirects to original ... > protocol is still SSL and not just http as expected. ... Site B - An application which does authentication which is https based ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Are http links after signing in with https secure?
    ... With the exception of client cert authentication, protocol and authentication methods are completely separate issues. ... site that is http the authentication info is forwarded again. ... > If IIS only accepts SSL requests, then those links using HTTP will fail. ...
    (microsoft.public.isa.publishing)
  • Re: ASP.NET and SSL question
    ... My understanding is that the scope of using SSL is one http request. ... I have an ASP.NET 2.0 application with an ASP.NET login control in the ... all the other pages require authentication. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Web mail intercepted! How?
    ... > use SSL in the authentication phase only, ... Gmail always uses SSL for authentication. ... it with http://gmail.google.com/, it will use HTTP after you ...
    (Security-Basics)
  • Re: ISA 2004 Server Errors
    ... Tunneling SSL Through a WWW Proxy ... CONNECT is really a lower-level function than the rest of the HTTP methods, ... Through ISA Server ...
    (microsoft.public.isa)