asp.net mvc - AntiForgeryConfig.RequireSsl causes random errors when using without SSL -

our security team requires cookies set secure=true.

to set secure property mvc antiforgery, using following code:

    protected void application_beginrequest(object sender, eventargs e)     {         antiforgeryconfig.requiressl = httpcontext.current.request.issecureconnection;     }  

but have problem on our test server not using ssl. have spontaneous errors

the anti-forgery system has configuration value antiforgeryconfig.requiressl = true, current request not ssl request. 

when looking in asp.net mvc code pinpoint location of exception, found following

private void checksslconfig(httpcontextbase httpcontext) {     if (_config.requiressl && !httpcontext.request.issecureconnection)     {         throw new invalidoperationexception(webpageresources.antiforgeryworker_requiressl);     } } 

it seems correct , should work because execution sequence is

    antiforgeryconfig.requiressl = httpcontext.current.request.issecureconnection;     // ... happens in between         if (_config.requiressl && !httpcontext.request.issecureconnection)         {             throw new invalidoperationexception(webpageresources.antiforgeryworker_requiressl);         } 

but seems requests httpcontext.current.request.issecureconnection returning true although not using ssl on our test server.

what's going on there? why exception?

i searching information antiforgeryconfig.requiressl , found question. in following code:

protected void application_beginrequest(object sender, eventargs e) {     antiforgeryconfig.requiressl = httpcontext.current.request.issecureconnection; }  

you modify application level value (antiforgeryconfig.requiressl) local value (request.issecureconnection).

if have 2 requests different request.issecureconnection value, think happen ? - first request set antiforgeryconfig.requiressl false - second request set antiforgeryconfig.requiressl true - first request evaluated checksslconfig (true) - second request evaluated checksslconfig (true)

you must avoid modifying global application setting way , write own filter handle kind of behavior.