My team is developing a component for SharePoint 2010, it has one Web Application scoped feature, all it does is add the following into web.config:

<httpCookies requireSSL="true" />


    <forms requireSSL="true">
        /* forms content */

My task is to test the functionality and verify that SSL (https) is really required (checking if the entries are in the config file is not enough) I need to verify this from user (browser) perspective.

I have Fiddler installed, and can inspect the traffic between browser and server, but I just don't know what to look for.

Problem is, when I go to a SP site in my environment using http, I immediately get asked for credentials and get redirected to https. Does this mean I can't verify this in current configuration? If so, what do I need to change? Or is it possible after all? What are the symptoms of requiressl being set to true as opposed to false?

migrated from stackoverflow.com Apr 19 '14 at 19:39

This question came from our site for professional and enthusiast programmers.

  • So I've created a new webapplication that uses http instead of https. I can't spot any meaningful difference in communication whether or not those settings are in web.config. Any ideas? – Shaggydog Apr 1 '14 at 11:53

The MSDN Article about requireSSL=true specifies that A. you must be using forms authentication or the setting is meaningless, and B. that this means that the connection must be secure to transmit the forms authentication cookie between server and client.

What you're looking to have happen is an exception be thrown like this when you try to log in:

Stack trace:

System.Web.HttpException: The application is configured to issue secure cookies.
These cookies require the browser to issue the request over SSL (https protocol).
However, the current request is not over SSL.
  at System.Web.Security.FormsAuthentication.SetAuthCookie(String userName, Boolean createPersistentCookie, String strCookiePath)

Something like that should be thrown if you try to access the site over HTTP, but not over HTTPS. However, when you say "forms" authentication, are you talking about ASP.NET Forms Authentication or something like ADFS where you go out to a third-party (in this case ADFS is third-party to SP) provider, which then generates the cookie? In that case, neither of these options mean much, since ADFS would be the one accepting the credentials and sending cookies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy