up vote 0 down vote favorite
share [g+] share [fb]

Is there any problem with using a 301 redirect to force all traffic to go to a secure-only site? We originally had redirect rules, but enforcing SSL-only seemed more secure. Here is how we set it up:

Site 1:  https://example.com/ 
  Require SSL set
  Bound to 443 only

Site 2:  http://example.com
  Bound to 80 only
  Empty folder - no actual html or other data
  301 Redirects to https://example.com

This seems to work beautifully, but are there any issues with doing this? Would any browsers not recognize the 301 redirect, or could there be security warnings during the redirect?

link|improve this question
79% accept rate
You could do the same with just 1 site (bound to both 80 & 443) and redirect all HTTP requests to HTTPS with the help of 1 URL Rewrite Rule. The end result will be exactly the same. – LazyOne Jun 28 '11 at 7:47
1  
The problem is that we end up relying on the rewrite rules, which someone could screw up since they're under control of developers (i.e. in web.config) – Jess Jun 28 '11 at 15:11
Agree, that sometimes can be problematic to keep under control – LazyOne Jun 28 '11 at 15:14
feedback

1 Answer

up vote 1 down vote accepted

As long as you use a full domain name (www.dom.com) you won't receive any SSL warnings.

Redirecting with a 301 will not cause any issues; simply put, it's a big part of the HTTP 1.0/1.1 protocols and should not cause any issues with any 'real' browsers or bots.

link|improve this answer
Thanks - one of my big concerns was that everyone on the web was suggesting code changes, fancy URL rewriting logic, and other methods to enforce SSL. My 'solution' seemed so simple that I figured I missed something. – Jess Jun 28 '11 at 5:52
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.