IIS Default document breaks https redirection

Question

I have a very old webforms site which I'm trying to add HTTPS redirection to using this config:

<system.webServer>
        <rewrite>
            <rules>
                <rule name="Force HTTPS" enabled="true" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="^OFF$" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" />
                </rule>
            </rules>
        </rewrite>
</system.webServer>

However this bit of config causes a redirect loop

<defaultDocument>
            <files>
                <add value="Home.aspx" />
            </files>
</defaultDocument>

Looking at the network tab in the browser the site redirects from http://mysite.it/ to https://mysite.it/ which is expected. However, then it gets redirected to http://mysite.it/Homes.aspx which redirects to https://mysite.it/Homes.aspx again expected. But then after that, it gets redirected back to http://mysite.it/Homes.aspx again and from there it just continues to loop.

I'm not really sure how to stop this behaviour and there is few resources that give detail. I'm also not very familiar with IIS and webforms.

Any help appreciated, thanks!

Answer 1

You can try to use this URL Rewrite rule:

<rewrite>
  <rules>
    <rule name="Test" stopProcessing="true">
        <match url="^(.*)$" ignoreCase="false" />
        <conditions>
            <add input="{HTTP_X_FORWARDED_PROTO}" pattern="^http$" ignoreCase="false" />
         </conditions>
      <action type="Redirect" url="https://{SERVER_NAME}{URL}" redirectType="Found" />
    </rule>
  </rules>
</rewrite>

SERVER_NAME : The server's host name, DNS alias, or IP address as it would appear in self-referencing URLs.

URL : The base portion of the URL without any querystring information.

The meaning of the following rule is that if the HTTP header X-Forwarded-Proto contains "https", the rule will not perform redirection.

<add input="{HTTP_X_FORWARDED_PROTO}" pattern="^http$" ignoreCase="false" />

This rule will avoid circular redirects.