Our application currently has a HTTP-redirect to HTTPS. Now we want to completely remove this HTTP-binding because of security reasons, and have our users only use HTTPS by configuring "Require SSL" in IIS.
The problem is that we still have about 10% of users that make use of this HTTP-redirect page so we cannot just turn off the HTTP-redirect. A lot of users might end up calling the helpdesk.
Now an idea is to in a first release have the HTTP-redirect page link to a new page which contains information on the new link to use. In a next release we can then turn on full "Require SSL".
This solution seems okay, but it would be nicer to have a HTTP redirect to the informational page and require SSL at the same time. Is this possible?
Any other suggestions regarding this issue are very welcome as well. Thanks.