1

We're looking at using HTTPS in our ASP.NET webforms application for a shopping cart section. I have read somewhere that we will need to write code to check if the users' browser/device has encryption to avoid it falling over?

Is this the case, if so can you point me in the direction of what sort of namespaces/blogs etc I should be looking at?

Any help appreciated.

Improve this question

3 Answers 3

Reset to default
3

This codeproject article - http://www.codeproject.com/KB/aspnet/WebPageSecurity.aspx - is likely worth a read.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

1

I recommend turning on SSL and seeing what breaks. Usually nothing. However, there are many edge cases, such as components that try to load from http:// instead of https://

Most of the relevant configurations will be in IIS or the web.config file. You will need to set several attributes especially if you using forms authentication or the ASP.NET membership feature.

Here is one link to start your reading.

Improve this answer

Comments

1

I think you may be referring to the 40 bit/128 bit encryption question, which used to be an issue up to IE 5.5. I don't think this should be a concern today. See the Verisign FAQ for some basic info about SGC certs.

Improve this answer

1 Comment

Note that 40 bit encryption is not acceptable for money transactions, even if the user does not have support for 128 bit encryption. If the user can't handle 128 bit encryption, you cannot allow them to provide payment details online. If you do enough business, this will probably be enforced when your security testing company (the use of which will be mandated by your CC processor) checks over your site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.