重定向到AWS负载均衡器后面的IIS上的HTTPS在IE中不起作用

Question

I am trying to force HTTPS on my site that is hosted using Elastic Beanstalk on AWS. Because it is on AWS and the AWS Loadbalancer inserts it's own redirect rule on IIS I can't use a Global Filter to force HTTPS. If I do this I get an error about too many rewrites.

Instead I have to use UrlRewrite and pass a rule from my web.config I'm using the rule that I got from another answer on SO. This is very similar to most of the answers out there for forcing HTTPS

<rule name="HTTP to HTTPS" stopProcessing="true">
    <match url="(.*)" />
    <conditions>
        <add input="{HTTP_X_FORWARDED_PROTO}" pattern="https" negate="true" />
        <add input="{HTTPS}" pattern="^OFF$" ignoreCase="true"/>
        <add input="{REMOTE_HOST}" pattern="localhost" negate="true" />
        <add input="{REMOTE_ADDR}" pattern="127.0.0.1" negate="true" />
        <add input="{HTTP_HOST}" pattern="localhost" negate="true" />
    </conditions>
    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
</rule>

This rule works in Safari & Chrome, but in IE the first time the user goes to the site it is HTTP until they click a link and then the next page is HTTPS. This behavior isn't too bad, but I have a form on my index and when you try to submit that in HTTP it refreshes the page and becomes HTTPS. The form submit works after that.

Thanks in advance for any help

Answer 1

If you are using asp.net mvc, you can use this code in your application class instead of configuration

public class MvcApplication : System.Web.HttpApplication
    {
        protected void Application_Start()
        {
            //Enforce Https to the web app.
            GlobalFilters.Filters.Add(new RequireHttpsAttribute());
        }
    }