Redirecting from http to https on SecureConnection is unable to pass values in POST request. How can I preserve them?

Question

In my project, I have an .ashx page which accepts POST requests from outside, and collects a string variable by using this code:

string infoPost = httpRequest["infoPost"].ToString();

This code works perfectly on my local, or an IIS server.

The problem started when I published it to an IIS server which I dont have control over it. Somehow the object was coming empty and I was getting "Object reference not set to an instance of an object." error on this code.

I did a bit of research, and found out that the SecureConnection setting is causing the problem. IIS server converts all "http" requests to "https", but it loses infoPost variable while doing that. I tested this idea by calling this page with "https" directly, and this time the code worked perfectly, and I grabbed the posted string.

But I dont want hardcoded job. I tried to understand if the website set as a secureconnection or not by using this code:

 string strSecure = "http://";
 if (HttpContext.Current.Request.IsSecureConnection)
     strSecure = "https://";

Again, this code worked well on my local, but doesn't work on the IIS I mentioned.

Sorry for the long explanation, here are my questions in simple:

• When IIS somehow redirects http requests to https, it is unable to pass the parameters inside the POST. Is it true? How can I prevent it?
• I want to understand if a website is published on SecureConnection or not, but seems like "HttpContext.Current.Request.IsSecureConnection" code doesn't work on IIS. Is my assumption correct? Is there any other way to understand and decide which tag I should be using, (http or https)?

Answer 1

You don't want POSTed values to redirect from http to https, that would be a security hole. The purpose of this feature is to force you to confront whatever it is in the application that is POSTing values in clear-text, because they are being exposed before the redirect ever happens.