您还可以通过向浏览器返回“Strict-Transport-Security”报头来使用HSTS。浏览器必须支持这一点(目前主要是Chrome和Firefox支持)，但这意味着一旦设置好，浏览器将不会通过HTTP向站点发出请求，而是在发出请求之前将它们转换为HTTPS请求。尝试结合从HTTP重定向:

protected void Application_BeginRequest(Object sender, EventArgs e)
{
  switch (Request.Url.Scheme)
  {
    case "https":
      Response.AddHeader("Strict-Transport-Security", "max-age=300");
      break;
    case "http":
      var path = "https://" + Request.Url.Host + Request.Url.PathAndQuery;
      Response.Status = "301 Moved Permanently";
      Response.AddHeader("Location", path);
      break;
  }
}

不了解HSTS的浏览器将忽略头文件，但仍然会被switch语句捕获并发送到HTTPS。

请使用HSTS (HTTP严格传输安全)

从http://www.hanselman.com/blog/HowToEnableHTTPStrictTransportSecurityHSTSInIIS7.aspx

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="HTTP to HTTPS redirect" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
                        redirectType="Permanent" />
                </rule>
            </rules>
            <outboundRules>
                <rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
                    <match serverVariable="RESPONSE_Strict_Transport_Security"
                        pattern=".*" />
                    <conditions>
                        <add input="{HTTPS}" pattern="on" ignoreCase="true" />
                    </conditions>
                    <action type="Rewrite" value="max-age=31536000" />
                </rule>
            </outboundRules>
        </rewrite>
    </system.webServer>
</configuration>

原答案(2015年12月4日取代)

基本上

protected void Application_BeginRequest(Object sender, EventArgs e)
{
   if (HttpContext.Current.Request.IsSecureConnection.Equals(false) && HttpContext.Current.Request.IsLocal.Equals(false))
   {
    Response.Redirect("https://" + Request.ServerVariables["HTTP_HOST"]
+   HttpContext.Current.Request.RawUrl);
   }
}

它会被放到global。asax。cs(或global。asax。vb)

我不知道如何在web.config中指定它

如果您正在使用ASP。你可以试试这个包:赛达。aspnetcore . httpwithstricttransport security。

然后你只需要加

app.UseHttpsWithHsts(HttpsMode.AllowedRedirectForGet, configureRoutes: routeAction);

这也会将HTTP StrictTransportSecurity头添加到所有使用https方案的请求中。

示例代码和文档https://github.com/saidout/saidout-aspnetcore-httpswithstricttransportsecurity#example-code

如果你不能在IIS中设置这个，我会做一个HTTP模块，为你重定向:

using System;
using System.Web;

namespace HttpsOnly
{
    /// <summary>
    /// Redirects the Request to HTTPS if it comes in on an insecure channel.
    /// </summary>
    public class HttpsOnlyModule : IHttpModule
    {
        public void Init(HttpApplication app)
        {
            // Note we cannot trust IsSecureConnection when 
            // in a webfarm, because usually only the load balancer 
            // will come in on a secure port the request will be then 
            // internally redirected to local machine on a specified port.

            // Move this to a config file, if your behind a farm, 
            // set this to the local port used internally.
            int specialPort = 443;

            if (!app.Context.Request.IsSecureConnection 
               || app.Context.Request.Url.Port != specialPort)
            {
               app.Context.Response.Redirect("https://" 
                  + app.Context.Request.ServerVariables["HTTP_HOST"] 
                  + app.Context.Request.RawUrl);    
            }
        }

        public void Dispose()
        {
            // Needed for IHttpModule
        }
    }
}

然后将其编译为DLL，将其作为项目的引用添加到web.config中:

 <httpModules>
      <add name="HttpsOnlyModule" type="HttpsOnly.HttpsOnlyModule, HttpsOnly" />
 </httpModules>

I'm going to throw my two cents in. IF you have access to IIS server side, then you can force HTTPS by use of the protocol bindings. For example, you have a website called Blah. In IIS you'd setup two sites: Blah, and Blah (Redirect). For Blah only configure the HTTPS binding (and FTP if you need to, make sure to force it over a secure connection as well). For Blah (Redirect) only configure the HTTP binding. Lastly, in the HTTP Redirect section for Blah (Redirect) make sure to set a 301 redirect to https://blah.com, with exact destination enabled. Make sure that each site in IIS is pointing to it's own root folder otherwise the Web.config will get all screwed up. Also make sure to have HSTS configured on your HTTPSed site so that subsequent requests by the browser are always forced to HTTPS and no redirects occur.

对于那些使用ASP。净MVC。您可以使用以下两种方式在整个站点上强制使用HTTPS之上的SSL/TLS:

艰难的方式

1 -添加requirehttpattribute到全局过滤器:

GlobalFilters.Filters.Add(new RequireHttpsAttribute());

2 -强制防伪造令牌使用SSL/TLS:

AntiForgeryConfig.RequireSsl = true;

3 -通过更改Web，要求cookie默认要求HTTPS。配置文件:

<system.web>
    <httpCookies httpOnlyCookies="true" requireSSL="true" />
</system.web>

4 -使用NWebSec。拥有NuGet包并添加以下代码行以启用整个站点的严格传输安全。不要忘记在下面添加Preload指令，并将您的网站提交到HSTS Preload站点。更多信息在这里和这里。请注意，如果您不使用OWIN，也可以使用Web。config方法，你可以在NWebSec网站上阅读。

// app is your OWIN IAppBuilder app in Startup.cs
app.UseHsts(options => options.MaxAge(days: 30).Preload());

5 -使用NWebSec。拥有NuGet包并添加以下代码行，以启用跨站点的公钥固定(HPKP)。更多信息在这里和这里。

// app is your OWIN IAppBuilder app in Startup.cs
app.UseHpkp(options => options
    .Sha256Pins(
        "Base64 encoded SHA-256 hash of your first certificate e.g. cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=",
        "Base64 encoded SHA-256 hash of your second backup certificate e.g. M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=")
    .MaxAge(days: 30));

6 -包括https方案在任何URL的使用。当您在某些浏览器中限制该方案时，内容安全策略(CSP) HTTP报头和子资源完整性(SRI)不能很好地发挥作用。对于HTTPS最好是明确的。如。

<script src="https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.4/bootstrap.min.js"></script>

简单的方法

使用ASP。NET MVC样板Visual Studio项目模板生成一个项目，所有这些和更多的内置。你也可以在GitHub上查看代码。