Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for the "best practice" way of secure site redirection with IIS7 and ASP.net. Say I have two domain names:

  • mydomain.com
  • mydomain.net

each with a www subdomain.

I have a single EV certificate that uses the common name:

  • www.mydomain.com

Therefore, the user can access the site 8 different possible ways:

- http://mydomain.com
- http://mydomain.net
- http://www.mydomain.com
- http://www.mydomain.net
- and also using https://

In order for the user to not receive certificate errors, he/she must be directed to

 - https://www.mydomain.com

What is the best way to make this work transparently to the user while still ensuring that IIS serves up only secure content? In the past I have used web.config to redirect to a sub page like this:

<system.webServer>

<httpRedirect destination="https://www.mydomain.com/secureSubPage" />

or with wildcard certificates using this block in a common base page:

 if (!Request.IsSecureConnection)
    {
        Response.Redirect(Request.Url.ToString().Replace("http:", "https:"), true);
        return;
    }
    if (!Request.Url.ToString().Contains(".com"))
    {
        Response.Redirect(Request.Url.ToString().Replace(".net", ".com"), true);
        return;
    }
share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

To force all traffic to use HTTPS on https://www.mydomain.com you can simply use a single rewrite rule:

<rules>
    <rule name="Force HTTPS" enabled="false" stopProcessing="true">
        <match url="(.*)" />
        <conditions logicalGrouping="MatchAny">
            <add input="{HTTPS}" negate="true" pattern="^ON$" />
            <add input="{HTTP_HOST}" negate="true" pattern="^www\.mydomain\.com$" />
        </conditions>
        <action type="Redirect" url="https://www.mydomain.com{REQUEST_URI}" appendQueryString="false" redirectType="Permanent" />
    </rule>
</rules>

This will redirect all non-HTTPS traffic, regardless of the domain name used to reach the site to https://www.mydomain.com. It will also redirect https://mydomain.com to https://www.mydomain.com. Because most SSL certificates nowadays include both the domain with and without www this will not cause an error in the browser.

The above redirect rule can not prevent users from reaching your site with for example https://www.mydomain.net. This is because the check on the host header name can only be done after the HTTPS session has been established and before that the browser will already show an error because the domain name does not match the common name of the certificate. The only way to prevent this is to use a separate IP address for the domain name mydomain.com and a separate IP address for all other domain names you want your site to be reachable under.

To do this, you set up your DNS to let (www.)mydomain.net (and any other domain names you want your site to be reachable on) to point to IP address X.X.X.1. This IP address is bound to a HTTP-only dummy site in IIS. The only purpose of this site is to redirect all traffic to https://www.mydomain.com using the following rewrite rule:

<rules>
    <rule name="Redirect to https://www.mydomain.com" enabled="false" stopProcessing="true">
        <match url="(.*)" />
        <conditions logicalGrouping="MatchAll">
            <add input="{HTTP_HOST}" negate="true" pattern="^www\.mydomain\.com$" />
        </conditions>
        <action type="Redirect" url="https://www.mydomain.com{REQUEST_URI}" appendQueryString="false" redirectType="Permanent" />
    </rule>
</rules>

You then set up another site on IP address X.X.X.2 using both HTTP and HTTPS for (www.)mydomain.com. Using the above rewrite rule (the first one) you force HTTPS and the use of the www.mydomain.com.

This solution will effectively make your website unreachable via HTTPS unless the correct domain mydomain.com is used but that also what you want because you don't have any valid certificates for the other domain names.

share|improve this answer
    
Using those rules, I am able to redirect any http traffic to https:www.mydomain.com, even http:mydomain.net. I am unable to redirect https:mydomain.com to https:www.mydomain.com. Since we are using an EV certificate, subdomains are not accepted. I am not a RegEX expert, nor even a good novice, am I missing something in your code? Thanks –  user1038451 Nov 15 '11 at 21:12
    
You can only redirect https://mydomain.com to https://www.mydomain.com if you certificate is also valid for mydomain.com. As I said, most certificate issuers do include that now as an alternative subject name. I have a Comodo EV certificate that supports the domain name both with and without www. If your certificate does not support this you're out of luck. PS: You could bind https://mydomain.com to a third IP address with a cheap non-EV certificate and let it redirect to https://www.mydomain.com. –  Marco Miltenburg Nov 15 '11 at 22:50
    
Okay, I must've misread what you had written. I was curious how that would be done as http is above ssl on the stack. Does Urlrewrite have any advantages over doing this in code via Request.IsSecureConnection? –  user1038451 Nov 15 '11 at 22:55
    
By using URLRewrite you force the use of SSL on the server level, independent of the application. SSL will be used for all requests. If you do it on the application level your application can decide when to swith back and forth between https and http. What method you use is a design decision although I think there is a trend now to use SSL for the entire session, for all requests. –  Marco Miltenburg Nov 15 '11 at 23:04
    
I see, thank you! –  user1038451 Nov 15 '11 at 23:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.