ASP.NET MVC [RequireHttps] - powrót do http

Question

Po umieszczeniu [RequireHttps] sprawie działania i użytkownikowi przełączników z HTTP na HTTPS, wszystkie kolejne linki pozostanie HTTPS ...

Czy istnieje sposób, aby powrócić do HTTP?

Answer 1

Technicznie można to zrobić

mogłeś look at the source z RequireHttpsAttribute i cofnij go.

W praktyce prawdopodobnie nie powinien

Jeśli sesja jest nadal żyje, it is generally inadvisable to return to HTTP. Może to być foundation for a variety of attacks, na przykład session hijacking.

Answer 2

jest dość szczegółowy opis tego, jak obsługiwać przełączanie z HTTPS z powrotem do HTTP dla konkretnych metod działania pod tym linkiem

http://blog.clicktricity.com/2010/03/switching-to-https-and-back-to-http-in-asp-net-mvc/

Answer 3

Oto Atrybut 'ExitHttpsIfNotRequired' używam:

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)] 
public class RetainHttpsAttribute : Attribute 
{ 
} 

public class ExitHttpsIfNotRequiredAttribute : FilterAttribute, IAuthorizationFilter 
{ 
    public void OnAuthorization(AuthorizationContext filterContext) 
    { 
     // Abort if it's not a secure connection 
     if (!filterContext.HttpContext.Request.IsSecureConnection) return; 

     if (filterContext.ActionDescriptor.ControllerDescriptor.ControllerName == "sdsd") return; 

     // Abort if it's a child controller 
     if (filterContext.IsChildAction) return; 

     // Abort if a [RequireHttps] attribute is applied to controller or action 
     if (filterContext.ActionDescriptor.ControllerDescriptor.GetCustomAttributes(typeof(RequireHttpsAttribute), true).Length > 0) return; 
     if (filterContext.ActionDescriptor.GetCustomAttributes(typeof(RequireHttpsAttribute), true).Length > 0) return; 

     // Abort if a [RetainHttps] attribute is applied to controller or action 
     if (filterContext.ActionDescriptor.ControllerDescriptor.GetCustomAttributes(typeof(RetainHttpsAttribute), true).Length > 0) return; 
     if (filterContext.ActionDescriptor.GetCustomAttributes(typeof(RetainHttpsAttribute), true).Length > 0) return; 

     // Abort if it's not a GET request - we don't want to be redirecting on a form post 
     if (!String.Equals(filterContext.HttpContext.Request.HttpMethod, "GET", StringComparison.OrdinalIgnoreCase)) return; 

     // Abort if the error controller is being called - we may wish to display the error within a https page 
     if (filterContext.ActionDescriptor.ControllerDescriptor.ControllerName == "Error") return; 

     // No problems - redirect to HTTP 
     string url = "http://" + filterContext.HttpContext.Request.Url.Host + filterContext.HttpContext.Request.RawUrl; 
     filterContext.Result = new RedirectResult(url); 
    } 
}