0

Is there any problem with using a 301 redirect to force all traffic to go to a secure-only site? We originally had redirect rules, but enforcing SSL-only seemed more secure. Here is how we set it up:

Site 1:  https://example.com/ 
  Require SSL set
  Bound to 443 only

Site 2:  http://example.com
  Bound to 80 only
  Empty folder - no actual html or other data
  301 Redirects to https://example.com

This seems to work beautifully, but are there any issues with doing this? Would any browsers not recognize the 301 redirect, or could there be security warnings during the redirect?

3
  • You could do the same with just 1 site (bound to both 80 & 443) and redirect all HTTP requests to HTTPS with the help of 1 URL Rewrite Rule. The end result will be exactly the same.
    – LazyOne
    Jun 28, 2011 at 7:47
  • 2
    The problem is that we end up relying on the rewrite rules, which someone could screw up since they're under control of developers (i.e. in web.config)
    – Beep beep
    Jun 28, 2011 at 15:11
  • Agree, that sometimes can be problematic to keep under control
    – LazyOne
    Jun 28, 2011 at 15:14

1 Answer 1

2

As long as you use a full domain name (www.dom.com) you won't receive any SSL warnings.

Redirecting with a 301 will not cause any issues; simply put, it's a big part of the HTTP 1.0/1.1 protocols and should not cause any issues with any 'real' browsers or bots.

1
  • Thanks - one of my big concerns was that everyone on the web was suggesting code changes, fancy URL rewriting logic, and other methods to enforce SSL. My 'solution' seemed so simple that I figured I missed something.
    – Beep beep
    Jun 28, 2011 at 5:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .