title: ASP.NET MVC Futures RequireSSL Attribute and Authorize Attribute Together
body: <p>Is anyone successfully using both the Authorize and RequireSSL (from MVC futures) attributes together on a controller?  I have created a controller for which I must enforce the rule that the user must be logged in and using a secure connection in order to execute.  If the user is not on a secure connection, I want the app to redirect to https, thus I am using Redirect=true on the RequireSSL attribute.  The code looks something like (CheckPasswordExpired is my homegrown attribute):</p>
  
  <pre><code>[Authorize]
  [RequireSsl(Redirect = true)]
  [CheckPasswordExpired(ActionName = "ChangePassword",
      ControllerName = "Account")]
  [HandleError]
  public class ActionsController : Controller
  {
      ....
  }
  </code></pre>
  
  <p>mysite.com/Actions/Index is the default route for the site and also the default page to redirect to for forms authentication.</p>
  
  <p>When I browse to <a href="http://mysite.com" rel="nofollow noreferrer">http://mysite.com</a>, what I want to get is the user redirected to a secure connection, and because they are not authenticated yet, to the login page.  What I get is an HTTP 400 error (Bad Request).  If I navigate to <a href="http://mysite.com/Account/Login" rel="nofollow noreferrer">http://mysite.com/Account/Login</a>, the redirect works, but neither my Account controller nor Login action method have the [Authorize] attribute.</p>
  
  <p>Anyone have any experience with using these two attributes together to achieve my objective?</p>
  
  <p>Thanks!</p>