2010

Forcing an SSL redirect using Coldfusion

Posted By : Shaun McCran
Related Categories: Security, Coldfusion

I've never really coded much around individual Secure templates, but this afternoon I found myself working in a framework where certain templates were required to be called with the 'https' URL instead of standard non secure URLs.

This turns out to be incredibly easy. There is a variable in the cgi scope that tells you if the request is served under a secure port or not, cgi.server_port_secure returns true or false (1/0), so you can use it to redirect people to where they should be.

view plain print about

1<cfif NOT cgi.server_port_secure>
2
3 <cflocation url="https://#cgi.server_name##cgi.script_name#"
4 addtoken="false">
5
6</cfif>

I've used other cgi values above as I've put this in a 'prefuseaction' function in a fusebox CFC controller file. That way all requests to any actions in that file are routed to the SSL equivalent.

Comments (7) |

Print |

Send |

del.icio.us |

Digg It! |

Linking Blogs |

Answer Questions

TweetBacks

Comments

[Add Comment] [Subscribe to Comments]

If cookies and sessions become involved, this can get tricky.

If this is something "important" that needs to be secure (e.g. involving payments/etc) then you should consider running a security scan against the site to check if it might be vulnerable to session fixation problems.

(Also, Jason Dean and Pete Freitag both write about security issues regularly - worth checking out their blogs if you haven't already.)

# Posted By Peter Boughton | 07/09/10 15:23

does that mean you have the **UK CMS working>

# Posted By daz | 07/09/10 15:27

Also add statuscode="301" for search engines to update their links.

# Posted By Jules Gravinese | 07/09/10 17:40

@Jules, good point, always nice if Google etc is actually pointing to the right place first time.

@peter luckily this platform is session free, but that is a consideration. I guess you could replicate the cookie scope using Google crossdomain code to 'bridge' from http to https.

@daz still got that issue, my resource tells me its not SSL related tho, but account file permissions, got someone on it now :-)

# Posted By Shaun McCran | 08/09/10 10:11

Oh, also... I like to keep stuff like this out of the application server. It's not really part of the application logic. So let the web server handle it. Use htaccess with either apache or isapi_rewrite.

# Posted By Jules Gravinese | 08/09/10 14:59

I'm using isapi rewrite, I'd never really considered using that to redirect to https URL's. I think it can do a lot more than I've really gotten it to do.

Need to brush up on my regex really, wonder if there is a re write 'cook book' style site.

# Posted By Shaun McCran | 12/09/10 10:42

Very good content about Forcing an SSL redirect using Coldfusion as well as very easy.

# Posted By Wildcard SSL Certificate | 12/10/10 10:02

[Add Comment]

Shaun Mccran

Forcing an SSL redirect using Coldfusion