MVC RequireHttps butun sayt

RequireHttpsAttribute ni global filtr sifatida ro'yxatdan o'tkazing.

global.asax saytida:

protected void Application_Start()
{
    GlobalFilters.Filters.Add(new RequireHttpsAttribute());

    //... other stuff
}

Saytni HTTPS ga o'tishga majbur qilish uchun IIS URL Rewrite 2.0 dan foydalandim. web.config-dagi ushbu kod shunday qiladi:

  <system.webServer>
    <!-- This uses URL Rewrite 2.0 to force the entire site into SSL mode -->
    <rewrite xdt:Transform="Insert">
      <rules>
        <rule name="Force HTTPS" enabled="true">
          <match url="(.*)" ignoreCase="false" />
          <conditions>
            <add input="{HTTPS}" pattern="off" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="true" redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>

Siz har doim global.asax saytida dastur darajasida chek qo'shishingiz mumkin

protected void Application_BeginRequest(Object sender, EventArgs e)
{
   if (!HttpContext.Current.Request.IsSecureConnection)
   {
    Response.Redirect("https://" + Request.ServerVariables["HTTP_HOST"]
                                 + HttpContext.Current.Request.RawUrl);
   }
}

Bu javobni MVC 3 va undan yuqori uchun yangilash uchun App_start jildidagi Filterconfig.cs faylida quyidagilardan foydalaning.

        filters.Add(new RequireHttpsAttribute());

Shubhasiz, sizga amaldagi SSL sertifikatidan foydalanish uchun sozlangan serverlaringiz IIS kerak boʻladi, arzon sertifikatlarni bu yerda xarid qilish mumkin: https://www.namecheap.com/ Men oxirgi marta domenni sotib olganimda yiliga domen uchun $9 edi.

FilterConfig.cs-da buni qo'llang:

public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
     // only if Debug is not enabled, do not require https for local development
     if (!HttpContext.Current.IsDebuggingEnabled)
          filters.Add(new RequireHttpsAttribute());

     //... any other filters
}

Bu sizning ilovangizni har bir sahifada https dan foydalanishga majbur qilishi kerak.

Bu RequireHttps dan foydalanmayapti, lekin menimcha, bu yaxshiroq yechim, chunki u qayta yoʻnaltirishni tezroq ushlaydi MVC hayot aylanishi.

public class RedirectModule : IHttpModule
{
    private HttpApplication _context;

    public void Init(HttpApplication context)
    {
        _context = context;
        _context.PostResolveRequestCache += HttpRedirect;
    }

    public void HttpRedirect(Object src, EventArgs args)
    {
        if (_context.Request.Url.Scheme == Uri.UriSchemeHttp)
        {
            //Redirect to https
            var scheme = Uri.UriSchemeHttps + "://";
            var authority = _context.Request.Url.Authority;
            var url = _context.Request.RawUrl;

            var redirectTo = scheme + authority + url;
            _context.Response.PermanentRedirect(redirectTo);
        }
    }

    public void Dispose() { }
}

G‘oya ushbu maqoladan kelib chiqqan.

Siz modulni Web.config yoki Global.asax ichida ro'yxatdan o'tkazishingiz mumkin. Men sizga web.cofig da ko'rsataman.

<system.webServer>
    <modules>
        <add name="ConfigModuleName" type="Your.Namespace.RedirectModule"/>
    </modules>
</system.webServer>

MVC 6 (ASP.NET Core 1.0) filtrlarni ro'yxatdan o'tkazishda biroz farq qiladi:

Startup.cs - RequireHttpsAttribute:

public void ConfigureServices(IServiceCollection services)
{
    // TODO: Register other services

    services.AddMvc(options =>
    {
        options.Filters.Add(typeof(RequireHttpsAttribute));
    });
}

Dizayn qarorlari tushuntirildi:

1. Global sozlash uchun Startup.cs da filtrdan foydalaning (chunki bu hamma joyda qo‘llanilishini xohlaymiz). Startap barcha global qoidalarni ro'yxatdan o'tkazish va o'rnatish uchun javobgar bo'lishi kerak. Agar sizning kompaniyangiz yangi ishlab chiquvchini ish bilan ta'minlasa, u Startup.cs da global sozlashni topishini kutadi.
2. RequireHttpsAttribute mantiqidan foydalaning, chunki u tasdiqlangan (Microsoft tomonidan). Hech qachon "http://" va "https://" kabi "sehrli" satrlardan foydalanmang, agar bir xil mantiqni ta'minlash uchun yaratilgan Microsoft komponentini qayta ishlatish orqali oldini olish mumkin.

Agar siz MVC veb-saytingizni SSL holda localhost-da ishlayotgan bo'lsangiz:

• http://localhost:1337/ (SSL yo'q)
• https://localhost:1337/ (SSL)

https://stackoverflow.com/a/38244992/1095493 ko‘rib chiqing.

Eslatma:

alternativ sifatida biz "klass BaseController : Controller" ni yaratishimiz va barcha kontrollerlarimizni "BaseController" dan (Controller o'rniga) meros qilib olishimiz mumkin. Keyin biz faqat atribut 1 global joyni o'rnatishimiz kerak (va filtrni Startup.cs da ro'yxatdan o'tkazish shart emas).

Ba'zi odamlar atribut uslubini afzal ko'rishadi.

Foydalanish misoli:

[RequireHttpsAttribute]
public class BaseController : Controller
{
    // Maybe you have other shared controller logic..
}

public class HomeController : BaseController
{
    // Add endpoints (GET / POST) for Home controller
}

Global.asax.cs sahifasida global atributlarni ro'yxatdan o'tkazish uchun "RegisterGlobalFilters" dan foydalaning.

public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
    filters.Add(new RequireHttpsAttribute());
    //e.g. filters.Add(new HandleErrorAttribute());
    //e.g. filters.Add(new System.Web.Mvc.AuthorizeAttribute());            
}

Siz barcha kontrollerlaringiz uchun asosiy sinfdan foydalanishingiz mumkin va uni talab ssl atributi bilan bezashingiz mumkin.