你需要做的是:

1)在web中添加一个键。配置，取决于生产或阶段服务器如下所示

<add key="HttpsServer" value="stage"/>
             or
<add key="HttpsServer" value="prod"/>

2)在Global内部。Asax文件添加如下方法。

void Application_BeginRequest(Object sender, EventArgs e)
{
    //if (ConfigurationManager.AppSettings["HttpsServer"].ToString() == "prod")
    if (ConfigurationManager.AppSettings["HttpsServer"].ToString() == "stage")
    {
        if (!HttpContext.Current.Request.IsSecureConnection)
        {
            if (!Request.Url.GetLeftPart(UriPartial.Authority).Contains("www"))
            {
                HttpContext.Current.Response.Redirect(
                    Request.Url.GetLeftPart(UriPartial.Authority).Replace("http://", "https://www."), true);
            }
            else
            {
                HttpContext.Current.Response.Redirect(
                    Request.Url.GetLeftPart(UriPartial.Authority).Replace("http://", "https://"), true);
            }
        }
    }
}

如果你不能在IIS中设置这个，我会做一个HTTP模块，为你重定向:

using System;
using System.Web;

namespace HttpsOnly
{
    /// <summary>
    /// Redirects the Request to HTTPS if it comes in on an insecure channel.
    /// </summary>
    public class HttpsOnlyModule : IHttpModule
    {
        public void Init(HttpApplication app)
        {
            // Note we cannot trust IsSecureConnection when 
            // in a webfarm, because usually only the load balancer 
            // will come in on a secure port the request will be then 
            // internally redirected to local machine on a specified port.

            // Move this to a config file, if your behind a farm, 
            // set this to the local port used internally.
            int specialPort = 443;

            if (!app.Context.Request.IsSecureConnection 
               || app.Context.Request.Url.Port != specialPort)
            {
               app.Context.Response.Redirect("https://" 
                  + app.Context.Request.ServerVariables["HTTP_HOST"] 
                  + app.Context.Request.RawUrl);    
            }
        }

        public void Dispose()
        {
            // Needed for IHttpModule
        }
    }
}

然后将其编译为DLL，将其作为项目的引用添加到web.config中:

 <httpModules>
      <add name="HttpsOnlyModule" type="HttpsOnly.HttpsOnlyModule, HttpsOnly" />
 </httpModules>

对于上面的@Joe，“这是给我一个重定向循环。在我添加代码之前，它工作得很好。有什么建议吗?——乔11月8日11月4点13分

这种情况也发生在我身上，我认为发生的情况是有一个负载均衡器在Web服务器前终止SSL请求。因此，我的Web站点总是认为请求是“http”，即使原始浏览器要求它是“https”。

I admit this is a bit hacky, but what worked for me was to implement a "JustRedirected" property that I could leverage to figure out the person was already redirected once. So, I test for specific conditions that warrant the redirect and, if they are met, I set this property (value stored in session) prior to the redirection. Even if the http/https conditions for redirection are met the second time, I bypass the redirection logic and reset the "JustRedirected" session value to false. You'll need your own conditional test logic, but here's a simple implementation of the property:

    public bool JustRedirected
    {
        get
        {
            if (Session[RosadaConst.JUSTREDIRECTED] == null)
                return false;

            return (bool)Session[RosadaConst.JUSTREDIRECTED];
        }
        set
        {
            Session[RosadaConst.JUSTREDIRECTED] = value;
        }
    }

I'm going to throw my two cents in. IF you have access to IIS server side, then you can force HTTPS by use of the protocol bindings. For example, you have a website called Blah. In IIS you'd setup two sites: Blah, and Blah (Redirect). For Blah only configure the HTTPS binding (and FTP if you need to, make sure to force it over a secure connection as well). For Blah (Redirect) only configure the HTTP binding. Lastly, in the HTTP Redirect section for Blah (Redirect) make sure to set a 301 redirect to https://blah.com, with exact destination enabled. Make sure that each site in IIS is pointing to it's own root folder otherwise the Web.config will get all screwed up. Also make sure to have HSTS configured on your HTTPSed site so that subsequent requests by the browser are always forced to HTTPS and no redirects occur.

在IIS10 (Windows 10和Server 2016)中，从1709版本开始，有一个新的、更简单的选项可以为网站启用HSTS。

微软在这里描述了新方法的优点，并提供了许多不同的示例，说明如何通过编程或直接编辑ApplicationHost实现更改。配置文件(类似web。配置，但操作在IIS级别，而不是个别站点级别)。ApplicationHost。config可以在c:\ windows \ system32 \inetsrv\config目录下找到。

我在这里概述了避免链接失效的两个示例方法。

方法1 -编辑ApplicationHost。配置文件 在<site>标签之间，添加这一行:

<hsts enabled="true" max-age="31536000" includeSubDomains="true" redirectHttpToHttps="true" />

方法2—命令行: 从升高的命令提示符(即在CMD上用鼠标右键并以管理员身份运行)执行以下命令。请记住在IIS管理器中显示的站点名称与Contoso交换。

c:
cd C:\WINDOWS\system32\inetsrv\
appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.enabled:True" /commit:apphost
appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.max-age:31536000" /commit:apphost
appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.includeSubDomains:True" /commit:apphost
appcmd.exe set config -section:system.applicationHost/sites "/[name='Contoso'].hsts.redirectHttpToHttps:True" /commit:apphost

如果您处于访问受限的托管环境中，那么微软在文章中提供的其他方法可能是更好的选择。

请记住，IIS10版本1709现在可以在Windows 10上使用，但对于Windows Server 2016，它在不同的发布轨道上，并且不会作为补丁或服务包发布。点击这里了解1709年的详细信息。

对于那些使用ASP。净MVC。您可以使用以下两种方式在整个站点上强制使用HTTPS之上的SSL/TLS:

艰难的方式

1 -添加requirehttpattribute到全局过滤器:

GlobalFilters.Filters.Add(new RequireHttpsAttribute());

2 -强制防伪造令牌使用SSL/TLS:

AntiForgeryConfig.RequireSsl = true;

3 -通过更改Web，要求cookie默认要求HTTPS。配置文件:

<system.web>
    <httpCookies httpOnlyCookies="true" requireSSL="true" />
</system.web>

4 -使用NWebSec。拥有NuGet包并添加以下代码行以启用整个站点的严格传输安全。不要忘记在下面添加Preload指令，并将您的网站提交到HSTS Preload站点。更多信息在这里和这里。请注意，如果您不使用OWIN，也可以使用Web。config方法，你可以在NWebSec网站上阅读。

// app is your OWIN IAppBuilder app in Startup.cs
app.UseHsts(options => options.MaxAge(days: 30).Preload());

5 -使用NWebSec。拥有NuGet包并添加以下代码行，以启用跨站点的公钥固定(HPKP)。更多信息在这里和这里。

// app is your OWIN IAppBuilder app in Startup.cs
app.UseHpkp(options => options
    .Sha256Pins(
        "Base64 encoded SHA-256 hash of your first certificate e.g. cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=",
        "Base64 encoded SHA-256 hash of your second backup certificate e.g. M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=")
    .MaxAge(days: 30));

6 -包括https方案在任何URL的使用。当您在某些浏览器中限制该方案时，内容安全策略(CSP) HTTP报头和子资源完整性(SRI)不能很好地发挥作用。对于HTTPS最好是明确的。如。

<script src="https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.4/bootstrap.min.js"></script>

简单的方法

使用ASP。NET MVC样板Visual Studio项目模板生成一个项目，所有这些和更多的内置。你也可以在GitHub上查看代码。