Table of Contents

IT:AD:Patterns:Secure the Line Strategy

Summary

Using HTTPS/ is only a first line of defense (it does not provide end to end encryption – only front server to front server encryption) but it is a good start.

Process

Therefore it's useful to have a way to ensure that all communications with the server are over HTTPS.

MVC

Using an Attribute Over the Action

using System;
using System.Linq;
using System.Net.Http;
using System.Web.Http.Filters;
using System.Web.Http.Controllers;
 
namespace WebAPI
{
 public class CustomHttpsAttribute : ActionFilterAttribute
 {
  public override void OnActionExecuting(HttpActionContext actionContext)
  {
   if (!String.Equals(actionContext.Request.RequestUri.Scheme, "https", StringComparison.OrdinalIgnoreCase))
   {
    actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.BadRequest)
    {
     Content = new StringContent("HTTPS Required")
    };
    return;
   }
  }
 }
}

References