Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • Tim York 5 posts 36 karma points
    Aug 13, 2009 @ 18:38
    Tim York
    0

    SSL/TLS secure pages...Where can I start?

    Hi all,

    Just started getting into Umbraco & I like it a lot so far...

    I have looked high & low but I have not been able to find much info on the support for SSL/TLS in umbraco.

    Can pages be secured on an individual page basis or can selected directories be secured?

    Where would you recommend I go to find this information?

    -Tim

  • Chris Koiak 700 posts 2626 karma points
    Aug 13, 2009 @ 19:17
    Chris Koiak
    101

    Hi,

    I don't know of any package for this but it's very simple to implement.

    1. Create a property on one or every doctype called 'EnableSSL'
    2. Create a macro (usually best a C# control) that checks the current pages 'Enable SSL' property.
    3. Add the macro to your master template
    4. If the property is set to true, 301 redirect  to the same page, but changing http to https

    You will also need to check you're navigation/link rendering to make sure they are outputing http/https correctly. However if they don't, they will still work, albeit with an additional 301 redirect.

    I don't know if there's any code around for this?

    Securing a directory may be 2 different things. If you mean a physical directory they this is better accomplished in IIS. However if you just mean a pages inherits it's SSL status from it's parent page, then you would just modify step 2 to do an hierarchical xpath search up the current pages parents.

    Search the forum for how to read the current page's properties and you'll hopefully find a good few resources.

  • Tim York 5 posts 36 karma points
    Aug 14, 2009 @ 08:09
    Tim York
    0

    Thanks for the great information Chris.

    I believe I could run with this now.

    What is the recommended or best practice method for redirects within an Umbraco user control? Is there a specific umbraco method?

     

     

     

  • Chris Koiak 700 posts 2626 karma points
    Aug 14, 2009 @ 09:06
    Chris Koiak
    0

    No specific method, just use standard C#/VB.NET code.

    Remember that for a 301 redirect you can't use Context.Response.Redirect(), you have to do something like

       Response.Status =   "301 Moved Permanently"   ;
    Response.AddHeader( "Location" ,"http://www.domainname.com/testpage.aspx" );
  • Paul Blair 466 posts 731 karma points
    Aug 14, 2009 @ 12:50
    Paul Blair
    0

    In your xslt it is also possible to set a https path directly. I do something like this:

    [code]

                  <xsl:when test="./ancestor-or-self::node [string(./data [@alias='useHTTPS']) = '1']">
                    <xsl:value-of select="FairlieAgile:NiceUrlFullyQualifiedPath(@id, 1, 0, 0)"/>
                  </xsl:when>

    [/code]

    (obviously this requires adding a useHTTPS field to your document.)

    The code to generate a https paths is:

    [code]

    using System;
    using System.Collections.Generic;
    using System.Text;
    using System.Web;

    namespace FairlieAgile.library
    {
        public class SSLPath
        {
            public static string NiceUrlFullyQualifiedPath(int nodeId, bool isSsl, bool isOverride, bool isEncoded)
            {
                string proto = "http";
                if (isSsl)
                    proto = "https";
                if (isOverride && HttpContext.Current.Request.IsSecureConnection)
                    proto = "https";
                if (isOverride && !HttpContext.Current.Request.IsSecureConnection)
                    proto = "http";
                string niceUrl = umbraco.library.NiceUrl(nodeId);

                if (niceUrl.IndexOf("http://") == -1 && niceUrl.IndexOf("https://") == -1)
                    niceUrl = proto + "://" + umbraco.library.RequestServerVariables("SERVER_NAME") + niceUrl;

                //if (proto == "https" && niceUrl.IndexOf(".aspx") == -1)
                //    niceUrl += ".aspx";

                if (isEncoded)
                    return HttpContext.Current.Server.UrlEncode(niceUrl);
                else
                    return niceUrl;
            }
        }
    }

    [/code]

     

  • Paul Blair 466 posts 731 karma points
    Aug 14, 2009 @ 12:52
    Paul Blair
    0

    lets try that again.

    In your xslt it is also possible to set a https path directly. I do something like this:

    [code]

                  <xsl:when test="./ancestor-or-self::node [string(./data [@alias='useHTTPS']) = '1']">
                    <xsl:value-of select="FairlieAgile:NiceUrlFullyQualifiedPath(@id, 1, 0, 0)"/>
                  </xsl:when>

    [/code]

    (obviously this requires adding a useHTTPS field to your document.)

    The code to generate a https paths is:

    [code]

    using System;
    using System.Collections.Generic;
    using System.Text;
    using System.Web;

    namespace FairlieAgile.library
    {
        public class SSLPath
        {
            public static string NiceUrlFullyQualifiedPath(int nodeId, bool isSsl, bool isOverride, bool isEncoded)
            {
                string proto = "http";
                if (isSsl)
                    proto = "https";
                if (isOverride && HttpContext.Current.Request.IsSecureConnection)
                    proto = "https";
                if (isOverride && !HttpContext.Current.Request.IsSecureConnection)
                    proto = "http";
                string niceUrl = umbraco.library.NiceUrl(nodeId);

                if (niceUrl.IndexOf("http://") == -1 && niceUrl.IndexOf("https://") == -1)
                    niceUrl = proto + "://" + umbraco.library.RequestServerVariables("SERVER_NAME") + niceUrl;

                //if (proto == "https" && niceUrl.IndexOf(".aspx") == -1)
                //    niceUrl += ".aspx";

                if (isEncoded)
                    return HttpContext.Current.Server.UrlEncode(niceUrl);
                else
                    return niceUrl;
            }
        }
    }

    [/code]

  • Paul Blair 466 posts 731 karma points
    Aug 14, 2009 @ 12:54
    Paul Blair
    0

    third times a charm....

    In your xslt it is also possible to set a https path directly. I do something like this:

                  <xsl:when test="./ancestor-or-self::node [string(./data [@alias='useHTTPS']) = '1']">
                    <xsl:value-of select="FairlieAgile:NiceUrlFullyQualifiedPath(@id, 1, 0, 0)"/>
                  </xsl:when>

    (obviously this requires adding a useHTTPS field to your document.)

    The code to generate a https paths is:

    using System;
    using System.Collections.Generic;
    using System.Text;
    using System.Web;

    namespace FairlieAgile.library
    {
        public class SSLPath
        {
            public static string NiceUrlFullyQualifiedPath(int nodeId, bool isSsl, bool isOverride, bool isEncoded)
            {
                string proto = "http";
                if (isSsl)
                    proto = "https";
                if (isOverride && HttpContext.Current.Request.IsSecureConnection)
                    proto = "https";
                if (isOverride && !HttpContext.Current.Request.IsSecureConnection)
                    proto = "http";
                string niceUrl = umbraco.library.NiceUrl(nodeId);

                if (niceUrl.IndexOf("http://") == -1 && niceUrl.IndexOf("https://") == -1)
                    niceUrl = proto + "://" + umbraco.library.RequestServerVariables("SERVER_NAME") + niceUrl;

                //if (proto == "https" && niceUrl.IndexOf(".aspx") == -1)
                //    niceUrl += ".aspx";

                if (isEncoded)
                    return HttpContext.Current.Server.UrlEncode(niceUrl);
                else
                    return niceUrl;
            }
        }
    }

     

  • Tim York 5 posts 36 karma points
    Aug 14, 2009 @ 19:48
    Tim York
    0

    Paul,

    Thanks for the code.

    The XSLT might as well be Chinese to me right now.  It is probably the most intimidating part of Umbraco to me right now but I will continue to work on it.

    Your c# code is valuable to me & pretty self explanatory.

  • Tim York 5 posts 36 karma points
    Aug 14, 2009 @ 23:12
    Tim York
    0

    Alright, I believe I am close to success but I am having a few issues...

    I followed Chris' suggestions above...

    1. Create a property on one or every doctype called 'EnableSSL'
    2. Create a macro (usually best a C# control) that checks the current pages 'Enable SSL' property.
    3. Add the macro to your master template
    4. If the property is set to true, 301 redirect  to the same page, but changing http to https

    Its not quite working properly yet...

    I use the pageload event to check the ssl property. Is the most efficient place to put this?

    From here I check the IS_SSL property and if it is true I call Paul's method. Then I redirect to the new path which is basically the same page with "https" replacing "http"

    The problem is that the page it refers to does not exist and it times out.

    Here is my code for the control which I use along with Pauls method above (NiceUrlFullyQualifiedPath).

     

            protected void Page_Load(object sender, EventArgs e)
            {
               Node n = umbraco.presentation.nodeFactory.Node.GetCurrent();
               Property is_ssl = n.GetProperty("IS_SSL");
               if (is_ssl == null) return;
               string i = is_ssl.Value;
               if (i == "1")
                  {
                      Response.Status = "301 Moved Permanently";
                      string httpsURL = NiceUrlFullyQualifiedPath(n.Id, true, false, false);
                      Response.AddHeader("Location", httpsURL); 
                  }
           }

     -Tim

  • Chris Koiak 700 posts 2626 karma points
    Aug 14, 2009 @ 23:16
    Chris Koiak
    0

    rather than

    string httpsURL = NiceUrlFullyQualifiedPath(n.Id, true, false, false);

    You could try

    string httpsURL = HttpContext.Current.Request.RawUrl.Replace("http://","https://");

    Check if HttpContext.Current.Request.RawUrl begins with 'http' if not then just append 'https://' to the start of RawUrl.

    
    
    
    
    
                
  • Tim York 5 posts 36 karma points
    Aug 15, 2009 @ 00:15
    Tim York
    1

    bingo.

    Got it working...

    Thanks for the help Chris...

    It took me a bit to configure an SSL certificate on my localhost for testing but it does work.

    I did have to change the code from rawurl to absoluteuri as rawurl did not seem to contain "http" in it.

    I also quickly realized I needed to only change the url if it is "http://" so as not to get stuck in a continuous loop. something i am quite good at.

    here is the code...

            protected void Page_Load(object sender, EventArgs e)
            {
    
                Node n = umbraco.presentation.nodeFactory.Node.GetCurrent();
                Property is_ssl = n.GetProperty("IS_SSL");
                if (is_ssl == null) return;
    
                  if (is_ssl.Value=="1")
                      if(HttpContext.Current.Request.Url.AbsoluteUri.Contains("http://"))
                  {
    
                      Response.Status = "301 Moved Permanently";
                      string httpsURL = HttpContext.Current.Request.Url.AbsoluteUri.Replace("http://", "https://");
                      Response.AddHeader("Location", httpsURL); 
                  }
    
            }
Please Sign in or register to post replies

Write your reply to:

Draft