I have read the previous posts about using the RequireHttpsAttribute to secure individual controllers:
ASP.NET MVC RequireHttps in Production Only
but is the
Register the RequireHttpsAttribute as a global filter.
RequireHttpsAttribute
In global.asax:
protected void Application_Start() { GlobalFilters.Filters.Add(new RequireHttpsAttribute()); //... other stuff }