different web.config settings for http and https

Is it possible to configure your web.config file of your asp.net website to use different settings for users accessing the site via HTTPS?

(eg. I need to have validateRequest attribute for https access set to false, 开发者_如何学编程but for internal access (using http) set to true...)

thanks!

For security reasons, I would recommend deploying internal and extenal sites a different sites altogether. That means you could use windows authentication internally and forms authentication externally, and change whatever other config settings you desire. It also means you can limit the attack surface for external evil-doers by not providing access to methods intended for internal users only.

Disable request validation in the Web.config file:

<system.web>
    <pages validateRequest="false"/>
</system.web>

And in the Global.asax file, add an event handler for BeginRequest along the lines of:

public class Global : HttpApplication
{
    public override Init()
    {
        base.Init();
        BeginRequest += ToggleValidation;
    }

    void ToggleValidation(object sender, EventArgs e)
    {
        if (Request.IsSecureConnection)
            Request.ValidateInput();
    }
}