Redirect from HTTP to HTTPS in ASP.NET

Redirect from HTTP to HTTPS in ASP.NET

1. Configuration in web.config file: Add the following code snippet inside the <system.webServer> section of your web.config file to enforce HTTPS redirection:

xml
<system.webServer>
  <rewrite>
    <rules>
      <rule name="Redirect to HTTPS" stopProcessing="true">
        <match url="(.*)" />
        <conditions>
          <add input="{HTTPS}" pattern="off" ignoreCase="true" />
        </conditions>
        <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
      </rule>
    </rules>
  </rewrite>
</system.webServer>

Explanation: The above code sets up a rewrite rule that matches any URL and checks if the HTTPS server variable is set to "off". If it is, it redirects the user to the same URL but with "https://" instead of "http://". The {HTTP_HOST} and {R:1} placeholders capture the host name and the captured URL segment, respectively, to construct the new HTTPS URL. The redirectType="Permanent" attribute specifies that the redirection should be permanent (HTTP 301).

2. Global.asax file: In the Application_BeginRequest event of your Global.asax file, add the following code to redirect non-HTTPS requests:

csharp
protected void Application_BeginRequest(object sender, EventArgs e)
{
    if (!Request.IsSecureConnection)
    {
        string url = Request.Url.ToString().Replace("http:", "https:");
        Response.Redirect(url);
    }
}

Explanation: The Application_BeginRequest event is triggered for each incoming request. The code checks if the current request is not using a secure connection (Request.IsSecureConnection). If it's not, it constructs the HTTPS URL by replacing "http:" with "https:" and performs a redirect to the new URL using Response.Redirect.

---

Redirect non-www to www domain in ASP.NET

1. Configuration in web.config file: Add the following code snippet inside the <system.webServer> section of your web.config file to redirect non-www requests to the www version of the domain:

xml
<system.webServer>
  <rewrite>
    <rules>
      <rule name="Redirect non-www to www" stopProcessing="true">
        <match url="(.*)" />
        <conditions>
          <add input="{HTTP_HOST}" pattern="^www\." negate="true" />
        </conditions>
        <action type="Redirect" url="https://www.{HTTP_HOST}/{R:1}" redirectType="Permanent" />
      </rule>
    </rules>
  </rewrite>
</system.webServer>

Explanation: The above code sets up a rewrite rule that matches any URL and checks if the HTTP_HOST server variable does not start with "www.". If it doesn't, it redirects the user to the same URL but with "www." prepended. The {HTTP_HOST} and {R:1} placeholders capture the original host name and the captured URL segment, respectively, to construct the new URL. The redirectType="Permanent" attribute specifies that the redirection should be permanent (HTTP 301).

2. Global.asax file: In the Application_BeginRequest event of your Global.asax file, add the following code to redirect non-www requests:

csharp
protected void Application_BeginRequest(object sender, EventArgs e)
{
    string host = Request.Url.Host.ToLower();
    if (!host.StartsWith("www."))
    {
        string url = Request.Url.ToString().Replace(host, "www." + host);
        Response.Redirect(url);
    }
}

Explanation: The Application_BeginRequest event is triggered for each incoming request. The code checks if the current request's host does not start with "www.". If it doesn't, it constructs the new URL by prepending "www." to the original host and performs a redirect to the new URL using Response.Redirect.