Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

IIS 7.

Normally I would add some addresses (client IP) with deny or allow status to IIS configuration to restrict access to web pages (so from IP A.A.A.A it would be possible to get to the web page, but from B.B.B.B not). However I have a setup with SSL as well, so user can enter

http://www.home.com

or

https://www.home.com

In the first case she/he will be redirected to https. However, when user explicitly enters the second form no matter what IP it is, she/he gets access all the time. I am surprised that settings for restricting access apply only to HTTP, not HTTPS. Anyway, the question is:

How can I restrict access to web pages (for HTTPS), or how I can make existing restriction for HTTP to work for HTTPS as well?

SOLVED

The solution is stupid-simple: it is required to change the default access to "deny" (however I don't understand how/why default=allow and allowing single user makes sense and can work). With default access set to deny it works as required, however oddly I (I am allowed to access the site) cannot use HTTP, only HTTPS.

share|improve this question
add comment

1 Answer 1

You can certainly limit a folder/virtual-directory/application in IIS to HTTPS only (HTTP requests will be redirected to HTTPS).

The method depends on the IIS version.

IIS7 and later (for Vista/2008/Win7/2008R2):

  • In the containing Web Site, ensure SSL is configured (i.e. a HTTPS/SSL binding and certificate are configured).
  • Select the right location in the folder tree
  • Use SSL Settings to select "Require SSL".

IIS6 and earlier:

  • In the properties of the web site configure certificate and SSL port.
  • In the properties of applicable folder in the Directory Security Tab click on Edit and select Require Secure Channel (SSL)
share|improve this answer
    
Thank you, but I think there is a misunderstanding -- I have https already enabled, this is not the problem. The problem is that when I allow access ONLY from a given IP (single IP) it works for HTTP (and appropriate error page is displayed), but when I access web page directly (typing https myself) there is no error, and I get access regardless of the IP (client IP). –  greenoldman Jul 31 '10 at 10:06
    
It works for me for both HTTP and HTTPS (but only with IPv4, can't seem to specify with IPv6, but in IIS7.5 that should be supported as well). –  Richard Aug 1 '10 at 8:52
    
I use IPv4 too. I set "allow IP" to some odd IP (not mine) and I cannot access http but I can access https without any problem. –  greenoldman Aug 3 '10 at 5:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.