<p>Supposing you have a form that collects and submits sensitive information and you want to ensure it is never accessed via insecure (non-HTTPS) means, how might you best go about enforcing that policy?</p>

[{'answer_id': 55014, 'author': 'Vaibhav', 'author_id': 380, 'author_profile': 'https://Stackoverflow.com/users/380', 'pm_score': 1, 'selected': False, 'text': '<p>Take a look at this: <a href="http://www.dotnetmonster.com/Uwe/Forum.aspx/asp-net/75369/Enforcing-https" rel="nofollow noreferrer">http://www.dotnetmonster.com/Uwe/Forum.aspx/asp-net/75369/Enforcing-https</a></p>\n\n<p>Edit: This shows solutions from an IIS point of view, but you should be able to configure about any web server for this.</p>\n'}, {'answer_id': 55020, 'author': 'Danimal', 'author_id': 2757, 'author_profile': 'https://Stackoverflow.com/users/2757', 'pm_score': 1, 'selected': False, 'text': '<p>In IIS? Go to security settings and hit "Require secure connection". Alternately, you can check the server variables in page load and redirect to the secure page.</p>\n'}, {'answer_id': 55024, 'author': 'Justin Voss', 'author_id': 5616, 'author_profile': 'https://Stackoverflow.com/users/5616', 'pm_score': 3, 'selected': False, 'text': '<p>If you\'re running Apache, you can put a <code>RewriteRule</code> in your <code>.htaccess</code>, like so:</p>\n\n<pre><code>RewriteCond %{HTTPS} "off"\nRewriteRule /mypage.html https://example.com/mypage.html\n</code></pre>\n'}, {'answer_id': 55029, 'author': 'pkaeding', 'author_id': 4257, 'author_profile': 'https://Stackoverflow.com/users/4257', 'pm_score': 1, 'selected': False, 'text': "<p>I'd suggest looking at the request in the code that renders the form, and if it is not using SSL, issue a redirect to the https URL.</p>\n\n<p>You could also use a rewite rule in Apache to redirect the user.</p>\n\n<p>Or, you could just not serve up the page via HTTP, and keep it only in the document root of your HTTPS site.</p>\n"}, {'answer_id': 55581, 'author': 'Eugene', 'author_id': 1155, 'author_profile': 'https://Stackoverflow.com/users/1155', 'pm_score': 3, 'selected': True, 'text': "<p>I think the most bullet-proof solution is to keep the code inside your SSL document root only. This will ensure that you (or another developer in the future) can't accidentally link to a non-secure version of the form. If you have the form on both HTTP and HTTPS, you might not even notice if the wrong one gets used inadvertently.</p>\n\n<p>If this isn't doable, then I would take at least two precautions. Do the Apache URL rewriting, and have a check in your code to make sure the session is encrypted - check the HTTP headers.</p>\n"}]
['https://Stackoverflow.com/questions/55010', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/4061/']