private bool ShouldForceSSL(HttpContextBase context) { return(!OnlyWhenAuthenticated || // If OnlyWhenAuthenticated == false, then we should force SSL context.Request.IsAuthenticated || // If Authenticated, force SSL (we should already be on SSL, since the cookie is secure, but just in case...) FormsAuthentication.ShouldForceSSL(context)); // If the "ForceSSL" cookie is present. }