SSL

[devtha]

Hi I have a small ASP page that queries the data from an Oracle database. The search is based upon the SSN provided on the screen that retieves personal info for that ssn on the same page.
Also the page will be at a remote location. So the data may be transfering over the net.
I was told to use SSL. I am new at ASP and I sure could use some pointers.
Also how do I format the data for display using html tags.?
Thanks in advance.
DT

 

[jackfl]

I haven't set up a secure site in a while, but here's what I remember...

Create a new web site for the secure content; probably from the page which requests the SSN number thru any display of sensitive information. This will look just like your existing web site config except it will be on port 443. You may also want to get a secure certificate so your users don't get a warning when hitting the secure portion.

The only difference in your tags is that they must treat this secure site as a separate site; your tags must be absolute between the non-secure and secure sites (http:// and

https://).

 

[Bullschmidt]

And here's a little more info for you too.

Get your own SSL certificate (perhaps at

http://www.thawte.com)

and be sure you have a Web host that will install it so that you don't have to switch servers and lose session variables.

Then you can access any of your pages with https instead of http.

But if you have SSL for your Web site that doesn't mean that everyone HAS to go in with https URL's. They can go in with http URL's too. So on the pages you want protected you may want to see how a user is coming in and redirect to https if needed...

For instance at my site only the sample Web database used to use SSL although SSL was available for the whole site.

But a tricky thing is that on your SSL pages you're going to want to be sure that all filepaths for included files and even images all use https and not http (or nothing because http is then assumed) otherwise the user will probably get a message from his browser saying there is secure and unsecure information on the page.

If you use secured pages on a different server you many want to find some way (such as by posting or via querystring) to pass in values such as for a shopping cart without using session variables. Or if you have access to the database from each server, you could store things in the database as a way of moving info from non-secured to secured pages or back again.


Best regards,
J. Paul Schmidt

http://www.Bullschmidt.com

- Freelance ASP Web Developer

http://www.Bullschmidt.com/DevTip.asp

- ASP Web Developer Tips