Entire website to migrate from Http to Https

Question

This seems like a duplicate question - but after hours of search, it seems there is no clear question-answer which summarize the issues i'm raising here.

We have a web application (built using asp.net MVC4) which stores customers sensitive customer information.

We've decided to migrate our entire application to https.

My question is, except for the IIS and certificates technical issues, which we've already know how to deal with, what should be changed on code level?

What will happen for instance for:

• Included external scripts containing http , such as: http://code.jquery.com/jquery-1.7.1.min.js - will it work automatically without any problem and popup messages or blocking on the client browsers?

• Internal links, which we've forgotten to change, which redirect to our site using http?

• Images/Sources which have http in their URL.

Should we change all references from http to relative, or just specifying // without the http/https protocol ? (as seen on other posts on this subject)

Should we do nothing, will it happen automatically?

Is there a way to do something in IIS or Global.asax etc, in order to automatically take care of all http leftovers?

What else should we take in account when migrating to https ?

Thanks in advance.

Answer 1

For all internal static resources hopefully you have used @Url.Content helper and for all internal dynamic resources you have used @Html.ActionLink , @Html.BeginForm , ... helpers to generate the links. This way you don't need to worry about anything.

For all external resources you could use // syntax in the link which will respect the protocol.

Since you are switching to HTTPS you might consider marking all your cookies (if any) with the secure flag to ensure that they are transmitted only over a secure channel.