This should be placed at the top of any page that is accessible by http:// but that you want accessed only through https://
<% if Request.ServerVariables("HTTPS") = "off" then srvname = Request.ServerVariables("SERVER_NAME") scrname = Request.ServerVariables("SCRIPT_NAME") response.redirect("https://" & srvname & scrname) end if ' continue "secure" code here %> |
As Ray points out, though, this will not carry over values from the Request.Form and/or Request.QueryString collections. So, if a user had posted a form to the above page, or , the behavior would not be as expected, because the values would be lost.
To solve this problem, we can add some logic:
<% if Request.ServerVariables("HTTPS") = "off" then method = Request.ServerVariables("REQUEST_METHOD") srvname = Request.ServerVariables("SERVER_NAME") scrname = Request.ServerVariables("SCRIPT_NAME") sRedirect = "https://" & srvname & scrname sQString = Request.Querystring if Len(sQString) > 0 Then sRedirect = sRedirect & "?" & sQString if method = "POST" then Response.Write "<form method=post action=" & _ sRedirect & " name='f'>" for x = 1 to Request.Form.Count() tname = Request.Form.Key(x) tvalue = Server.HTMLEncode(Request.Form.Item(x)) Response.Write "<input type=hidden name=" & _ tname & " value=""" & _ tValue & """>" & vbCrLf next Response.Write "<input type=submit value=Go></form>" Response.Write "<script>" & vbCrLf Response.Write "document.f.submit();" & vbCrLf Response.Write "</script>" else Response.Redirect sRedirect end if end if ' continue "secure" code here %> |
(Sorry, William Tasso, but the post method here relies on client-side script, so won't work for you — you'll actually have to click on the Go button.)