Question : Using Login In on Default page Http/Https

My website Introduces users to site via a default pages (http://domainName/Default.aspx) contained on page is user Login Control. Upon user authentication user is transfer to a role driven admin page or a member page (https://domainName/siteName/RoleDrivenPage.aspx). My problem is everyone needs access to see Default page because there are links to non-secure areas. I cannot set 'requireSSL= true' because default page resides on 'http', and when I set 'requireSSL=false' user logs in and then require to login again using https://domainName/siteName/Default.aspx.

Is there a way to use this Default/Login functionality?

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:



Web.config:

 <!--
            The <authentication> section enables configuration 
            of the security authentication mode used by 
            ASP.NET to identify an incoming user. 
        -->
    <authentication mode="Forms">
      <forms protection="All" name=".ASPXFORMSAUTH" loginUrl="Default.aspx" slidingExpiration="false"  timeout="10" requireSSL="true"
        cookieless="UseCookies" />
    </authentication>
    <!-- This section denies access to all files in this application except for those that you have not explicitly specified by using another setting. -->
    <authorization>
      <deny users="?" />
    </authorization>
    <httpCookies requireSSL="true" />
    <!--Memeber ship Class -->
    <membership defaultProvider="SqlProvider" userIsOnlineTimeWindow="15">
      <providers>
        <remove name="AspNetSqlProvider" />
        <add name="SqlProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="rmeaspnetdbConnectionString" applicationName="/" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" passwordFormat="Hashed"/>
      </providers>
    </membership>
    <!--Role Management goes here-->
    <roleManager defaultProvider="SqlProvider" enabled="true" cacheRolesInCookie="true" cookieProtection="All">
      <providers>
        <add name="SqlProvider" type="System.Web.Security.SqlRoleProvider" connectionStringName="rmeaspnetdbConnectionString"
             applicationName="/" />
      </providers>
    </roleManager>
  </system.web> <!-- Closing System.web inorder to apply location tags -->

  <!-- This section gives the unauthenticated user access to the Default1.aspx page only. It is located in the same folder as this configuration file. -->
  <location path="Default.aspx">
    <system.web>
      <authorization>
        <allow users ="*" />
      </authorization>
    </system.web>
  </location>
  <!-- This section gives the authenticated user access to all of the files that are stored in the Member Content Pages folder.  -->
  <location path="MemberContentPages">
    <system.web>
      <authorization>
        <deny users ="?" />
        <allow users = "*" />
      </authorization>
    </system.web>
  </location>
  <!-- This section gives the authenticated user with Role Administrator, Site Admin and Assistant access to all of the files that are stored in the Entity Content Pages folder.  -->
  <location path="EntityContentPages">
    <system.web>
      <authorization>
        <deny users ="?" />
        <deny roles = "Member" />
        <deny roles = "Client" />
      </authorization>
    </system.web>
  </location>

Answer : Using Login In on Default page Http/Https

>>> I thought of that and will do it at last resort.

I don't see why it should be a last resort. I have never seen the use in having a non-SSL portion of your site if you already have the SSL certificate to secure it.

>>> Login over HTTPS from HTTP

The HTTP or HTTPS describes the structure and flow between a client and a server. If I request a page from your server using HTTP, the response is sent in plain text. If that page has a link or a form to an HTTPS page, and I click it or submit the form, my client will initiate an SSL conversation with your server, and my subsequent request and your response will be sent as encrypted content. For a link, that takes the form of:

<a href="https://yourserver.com/page.php">

For a form:

<form name="myform" action="https://yourserver.com/formhandler.php" method="post">

The main thing you need to be aware of when switching to SSL is that other resources need to come from an SSL source also. Otherwise, the user receives a mixed-content warning. You can easily account for this behavior by using relative links in your resources. For example, instead of:

<img src="http://yourserver.com/images/image.jpg" />

Use this:

<img src="/images/image.jpg" />

The requests generated by the second example will automagically add the protocol and server name, since it is implied to be the same server and protocol as the original request.