if you find out that it is a proxy server, some proxy servers have a way to indicate to the web server whether it is a secure request often using a server variable, but you would have to know if that is the case and what the server variable is. Wehave logic to check for some config settings that can be set if one knows the name of a server variable that indicates if it is a secure request.
public static bool IsSecureRequest()
{
if((HttpContext.Current != null)&&(HttpContext.Current.Request != null))
{
// default this works when the SSL certificate is installed in the site but not when using load balancers or other proxy server
if (HttpContext.Current.Request.IsSecureConnection) { return true; }
if (WebConfigSettings.SecureConnectionServerVariableForPresenceCheck.Length > 0)
{
if (HttpContext.Current.Request.ServerVariables[WebConfigSettings.SecureConnectionServerVariableForPresenceCheck] != null) { return true; }
}
if ((WebConfigSettings.SecureConnectionServerVariableForValueCheck.Length > 0) && (WebConfigSettings.SecureConnectionServerVariableSecureValue.Length > 0))
{
if (HttpContext.Current.Request.ServerVariables[WebConfigSettings.SecureConnectionServerVariableForValueCheck] != null)
{
if (HttpContext.Current.Request.ServerVariables[WebConfigSettings.SecureConnectionServerVariableForValueCheck] == WebConfigSettings.SecureConnectionServerVariableSecureValue) { return true; }
}
}
}
return false;
}
the problem is with a proxy server the certificate is not installed in IIS, the proxy sits in front of IIS and passes the request without ssl to the web server but keeps it encrypted between the proxy server and the web browser. In this case since the web server is not securing the request, from its point of view it is not a secure request because this line of code will always be false:
HttpContext.Current.Request.IsSecureConnection
thus it tries to redirect again and again and it never sees a secure request from its point of view
whereas with a certificate installed directly in IIS that line would return true for a secure request