在asp.net中对整个站点强制使用https的最佳方法？

请使用HSTS

来自http://www.hanselman.com/blog/HowToEnableHTTPStrictTransportSecurityHSTSInIIS7.aspx

<?xml version="1.0" encoding="UTF-8"?><configuration>    <system.webServer>        <rewrite> <rules>     <rule name="HTTP to HTTPS redirect" stopProcessing="true">         <match url="(.*)" />         <conditions>  <add input="{HTTPS}" pattern="off" ignoreCase="true" />         </conditions>         <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"  redirectType="Permanent" />     </rule> </rules> <outboundRules>     <rule name="Add Strict-Transport-Security when HTTPS" enabled="true">         <match serverVariable="RESPONSE_Strict_Transport_Security"  pattern=".*" />         <conditions>  <add input="{HTTPS}" pattern="on" ignoreCase="true" />         </conditions>         <action type="Rewrite" value="max-age=31536000" />     </rule> </outboundRules>        </rewrite>    </system.webServer></configuration>

原始答案 （于2015年12月4日替换为上述内容）

基本上

protected void Application_BeginRequest(Object sender, EventArgs e){   if (HttpContext.Current.Request.IsSecureConnection.Equals(false) && HttpContext.Current.Request.IsLocal.Equals(false))   {    Response.Redirect("https://" + Request.ServerVariables["HTTP_HOST"]+   HttpContext.Current.Request.RawUrl);   }}

将会放在global.asax.cs（或global.asax.vb）中

我不知道在web.config中指定它的方法