Our hosting environment dictates all secure traffic music travel over a particular sub-domain.

We are using the .NET CMS Umbraco, which as far as I'm aware doesn't have any functionality to 'assign' a particular page to a sub-domain.

The scenario is:

  1. Our websites contains 1 page and 1 folder containing sub pages that must be secure
  2. A user requests /page or /page2/sub-page
  3. This traffic is redirected to HTTPS if the request came from HTTP
  4. If the HTTP_HOST does not contain the subdomain secure. then add it, otherwise proceed


Request equals /page2/page
301 redirect to https:// secure.{http_host}/{request}
Subsequent request must then be ignored (to avoid loop)

https:// secure.domain.com/page => NO CHANGE, remains the same
https:// domain.com/page => sub-domain inserted, https://secure.domain.com/page

In my mind the logic is:

INPUT = Full Url = http://www.domain.com/page

If INPUT contains HTTPS Then check Full URL, does it contain 'secure'? If YES do nothing, if no add 'secure'


Update 1, 19th August

Having thought about this I pieced together a two rules which are a step in the right direction:

This is what I propose:

One rule to force certain traffic to the secure domain:

<rule name="Force 'Umbraco' to secure" stopProcessing="true">
    <conditions logicalGrouping="MatchAll">
        <add input="{REQUEST_URI}" pattern="^/umbraco/(.+)$" ignoreCase="true" />
        <add input="{HTTP_HOST}" negate="true" pattern="^secure\.(.+)$" />
    <action type="Redirect" url="https://secure.{HTTP_HOST}/{R:0}" redirectType="Permanent" />

Another rule, that then removes the secure domain, expect for traffic on the secure domain.

<rule name="Remove secure, expect for Umbraco" stopProcessing="true">
    <match url="(.*)" ignoreCase="true" />
    <conditions logicalGrouping="MatchAll">
        <add input="{HTTP_HOST}" pattern="^secure\.(.+)$" />
        <add input="{REQUEST_URI}" negate="true" pattern="^/umbraco/(.+)$" ignoreCase="true" />
    <!-- Set Domain to match environment -->
    <action type="Redirect" url="http://staging.domain.com/{R:0}" appendQueryString="true" redirectType="Permanent" />

This works for a single directory or group of files, however I've been unable to add additional logic into those two rules. For example you might have 3 folders that need to be secure, I tried adding these as 'Negate records', but then no redirection happens at all.

Hmmm! L

  • Does your SSL Certificate include the domain.com and www.domain.com names? – Mathias R. Jessen Aug 6 '14 at 12:13
  • Hi Mathias, the certificate is specifically for that domain and does not contain 'www'. Thanks! /L – uniquelau Aug 6 '14 at 14:41
  • Then it won't work anyways, users will receive a browser warning before you'll have a chance to rewrite the url – Mathias R. Jessen Aug 6 '14 at 14:43
  • Sorry, my answer was a little confusing! The certificates are always valid, they make LOTS of them. – uniquelau Aug 6 '14 at 15:11

While useful, the redirect approach you propose does not offer the same security benefits as putting https urls in the right places on your pages in the first place.

If a user submits a request over HTTP, and receives a redirect response, then any data they have submitted will have travelled to your site in cleartext. You are only getting protection for the information that your site sends back to the user. This is better than nothing, but you do need to be careful with it.

For example, if you have a login form on the corner of your http page, with an http form target, then your users will be passing you login details in clear text, regardless of how you respond. On the other hand, if your http page has a link to an http login page, and you redirect that to an https version of the page, which presents the form with an https form target URL, then that's going to be more secure.

Can you even serve a redirect for https://domain.com/page? (as opposed to http). If you can serve a response, then exactly what limitation are you working around?

  • I can make the pages which are to be served over https have https in their URL's, but I would still need a mechanism to add the sub domain. Thanks, /L – uniquelau Aug 20 '14 at 14:33
  • How is it that you can receive the https request and serve a redirect, but you can't just serve the content on that URL? I suspect the answer is that you have an IP shared with other sites, and can only receive the request to the extent that the client supports <a hred="en.wikipedia.org/wiki/Server_Name_Indication">SNI</a>. Supporting https requests that don't use SNI is a good reason to use a separate IP (presumably associated with your subdomain), but in those cases you can't provide a redirect anyway. – mc0e Aug 21 '14 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.