I have web services built with ASP.NET and ASP.NET clients consuming them. When consuming the webservices, how would I to force the clients to use https?
I don't want to force the whole site to use https by turning on require SSL in IIS.
Can I use the IIS7 URL rewrite module to re-route http requests to https?
I need to force every request to https://www.mysite.com (always with https and www)
The site is hosted in GoDaddy and I need to do it via IIS7 URL Rewrite Module.
I've been able to do the HTTPS redirect with the following code:
<system.webServer>
<rewrite>
<rules>
<rule name="Canonical Host Name" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTP_HOST}" pattern="^mysite.com$" />
</conditions>
<action type="Redirect" url="https://www.mysite.com/{R:1}" redirectType="Permanent" />
</rule>
</rules>
</rewrite>
</system.webServer>
Test cases
http://mysite.com -> https://www.mysite.com OK
http://www.mysite.com -> https://www.mysite.com NOT WORKING
I guess the condition is not being satisfied when I enter www.mysite.com in the browser, so there's no redirect and the page serves as HTTP instead of HTTPS.
I think I just need to modify the condition pattern, but I have almost nothing regex knowledge and I need this asap.
I have the following setting in my web.config to redirect to a default page:
<defaultDocument>
<files>
<clear/>
<add value="default.aspx"/>
</files>
</defaultDocument>
For example when a user enters www.homeforhire.com they should be redirected to default.aspx (for operational reasons the user is then redirected to
www.homeforhire.com/home.aspx).
Instead an error is caught in the Rewrite module (which should not be activated). I am using an http module to perform URL rewriting.
It appears as if the default document setup is not working correctly, and the requested page ~/ is being sent to the Rewrite module, causing an error (which is then caught by my error handler and the user is redirected to the home page).
Entering www.homeforhire.com/default.aspx works correctly.
Can anyone tell me why the default document settings in the web.config do not appear to be working?
What's the simplest and most effective way to selectively redirect HTTP requests to your ASP.NET page to its HTTPS equivalent? For example, if my page site URL is [URL], I want to redirect some (or all) page requests to [URL] What's the easiest way to do that?
View 2 Repliesi redirect a page from http to https using http module begin request handler .i am calling webservice using ajax but it is saying webserice not defined .which otherwise works fineits work fine when rediect page in page_load instead .but i need to add function for https to http in every page. i still not know why ajax is not working when i use http module for redirect
View 3 RepliesIs it possible to use iis7 url rewrite module for html pages?
Like this:
http://www.site.com/index.html?x=newfolder =>
http://www.site.com/newfolder
Is it at all possible to use IIS7's rewrite capability in web.config to strip a particular HTTP header from a client request?We have an application that makes an HTTP POST to our website, and apparently the request contains the HTTP Expect header. Previously this was not a problem, but we've switched hosts and now the site is returning HTTP error 417 Expectation failed. So the real solution is to fix the software so it doesn't send the Expect header, but that can't happen soon enough for the folks in charge, who'd like to come up with an immediate web-based fix.I've used ISAPI_Rewrite before and I've read that it can strip a header, and the new host claimed they had ISAPI installed... but that seems to have been a lie, as I cannot get it to work, and support's only response on the subject is "use IIS7 Rewrite instead."
View 2 RepliesFor an ASP.NET 4.0 / IIS7 web app, I would like to support compressed HTTP requests. Basically, I would like to support clients that would add Content-Encoding: gzip in the request headers, and compress the body accordingly.
Does anyone known how I achieve such a behavior?
We are planning to move our website to https, which currently running on only http only. Web site is running on IIS7 in Windows 2008 server. Do I need to update/modify any configuration settings in the website to make it work on HTTPS? Is it fine just installing certifictes?
View 3 RepliesI use IIS 7 URL Rewrite Module and it works fine.
But My javascript code doesn't work anymore on the page (details.aspx) where i use URL Rewrite Module.
Example :
<a href="#" target="popup" onclick="wopen('note.aspx?ID=<%#CType(FormView1.DataItem, System.Data.DataRowView).Item("NoteID")%>&S=<%#CType(FormView1.DataItem, System.Data.DataRowView).Item("IsS")%>','popup',480,480); return false;">
Write a note</a>
If i disable the rule in IIS, this link works as expected.
The Rewrite rule doesn't include the note.aspx page.
I'm probably going to use the URL rewrite module for IIS 7 eventually and I have a fairly straight forward question that I really can't find the answer to.
If you have a base case of:
http://yoururl.com/page.aspx?ID=7
You can obviously have it rewritten to:
http://yoururl.com/page/7 or whatever you want.
My question is this: When using this module can you still use Request.Querystring["page"] on the rewritten querystring. How does the Request.URL stuff work. Does asp.net still provide the un-rewritten url or does it provide the rewritten one.
I would assume that your C#/asp.net code is completely unaffected by the url rewriting, as that's more or less the point, but I want to be crystal clear.
Secondary question: What is the best practice for how you should code a website when using the rewritten. Should you code links in the written style, or continue using querystrings?
I would like to use the Helicon ISAPI_REWRITE module to rewrite a url:
123.45.67.89/folder
to
www.site.com
I need to mask the IP/folder due to an IIS structure change. The reason why I don't want to get into, but it's valid based on the setup.
The IIS URL Rewrite Module ships with 3 built-in functions:
* ToLower - returns the input string converted to lower case.
* UrlEncode - returns the input string converted to URL-encoded format. This function can be used if the substitution URL in rewrite rule contains special characters (for example non-ASCII or URI-unsafe characters).
* UrlDecode - decodes the URL-encoded input string. This function can be used to decode a condition input before matching it against a pattern.
The functions can be invoked by using the following syntax:
{function_name:any_string}
The question is: can this list be extended by introducing a Replace function that's available for changing values within a rewrite rule action or condition?
Another way to frame the question: is there any way to do a global replace on a URL coming in using this module?
It seems that you're limited to using regular expressions and back-references to construct strings - i.e. there's no search/replace mechanism to replace every instance of X with Y in {REQUEST_URI}, without knowing how many instances there are.
I've had a quick glance at the extensibility introduced in the 2.0 RTW and don't see any 'light' means of introducing this.
Hello, I'm trying to implement URL rewriting for the first time. I must use URL Rewrite Module IIS7 per my hosting company. All of the examples I have found so far will rewrite a url such as:
www.domain.com/ShowProduct.aspx?ID=233&Title=Product-Title,
to: www.domain.com/ShowProduct/ProductTitle/233. The common scenario between these examples is that the rewrite chops off the .aspx & special characters and shuffles the query string parameters around. I get how that all works. However, I had something a little different in mind and I'm not sure if it can be accomplished.
My urls currently look like this: www.domain.com/ShowProduct?ID=233, and I would like them to look like this: www.domain.com/ShowProduct/Product-Title. The way I would imagine this working is, during the rewrite, pass the ID to the db and return the Title for the new url. You see, I currently don't need to pass the Title as a query string parameter and I'd prefer to not show the ID at all. This would be ideal. Can this be accomplished? Or
will I have to add the Title as a query string param and show the ID in rewritten url?
I have a website hosted on IIS7 with the url rewrite module 2.0 installed. It is run by content management that looks at the url and returns a 401 error if the current user does not have permission to view the page. This gets picked up by the asp.net url authorization module which then kicks the page over to the loginUrl page as specified in the web.config (forms authentication).
This works perfectly on my local machine - which is IIS7 and windows7.
If the url is, say, /612/some-string the user gets directed to the login page at /66/login?ReturnUrl=/612/some-string
The url rewriting looks at the first part of the url for the document id. The real url would be this: index.aspx?documentId=612
Unfortunately, when I deployed this to our staging server, the ReturnUrl isn't the rewritten url, it's the original url. This causes all sorts of problems.
The staging server is also IIS7 with the url rewrite module 2.0 installed. It's Windows 2008 server SP2. Both are running asp.net 3.5.
My only guess is that the machine.config orders the default httpModules differently, and the .net forms authentication module is jumping in before the url has been rewritten.
I'll review that soon, but in the meantime has anyone experienced this problem and solved it?
Update
I also tried changing
Response.StatusCode = 401;
to
FormsAuthentication.RedirectToLoginPage();
Which gets me a bit ahead, but still directs the user back to the url that hasn't been rewritten.
I can also do this instead of setting the 401:
string currentPage = HttpUtility.UrlEncode(Request.RawUrl);
string loginUrl = FormsAuthentication.LoginUrl + "?ReturnUrl=" + currentPage;
Response.Redirect(loginUrl);
But this seems ugly.
In our ASP.NET web application, we use our own class to act as a rewrite module. It takes all requests to the server, acting as a bootstrapper.
To access an image on our web application, the browser requests domain.com/ResourceItem.aspx?Id=74
Does not having a proper URI mean the server will never respond with 304 NOT MODIFIED?
how to get the 304 response, so the browser doesn't have to download each image every refresh?
Let's say a security tester uses a proxy, say Fiddler, and records an HTTPS request using the administrator's credentials-- on replay of the entire request (including session and auth cookies) the security tester is able to succesfully (re)record transactions. The claim is that this is a sign of a CSRF vulnerability.
What would a malicious user have to do to intercept the HTTPS request and replay it? It this a task for script kiddies, well funded military hacking teams or time-traveling-alien technology? Is it really so easy to record the SSL sessions of users and replay them before the tickets expire?
No code in the application currently does anything interesting on HTTP GET, so AFAIK, tricking the admin into clicking a link or loading a image with a malicious URL isn't an issue.
clear my concept What is HTTP module and HTTP Handler and how does they work while page requesting???
How authentication and Authorization process work in asp.net?
Experimenting with URL rewrites using this module, however I'm getting the following error when attempting to hit the URL. Looked online for answers, but not sure what the best way to get around this is...
HTTP Error 500.52 - URL Rewrite Module Error. Outbound rewrite rules cannot be applied when the content of
the HTTP response is encoded ("gzip"). IIS received the request; however, an internal error occurred during the processing of the request. The root cause of this error depends on which module handles the request and what was happening in the worker process when this error occurred. IIS was not able to access the web.config file for the Web site or application. This can occur if the NTFS permissions are set incorrectly. IIS was not able to process configuration for the Web site or application. The authenticated user does not have permission to use this DLL. The request is mapped to a managed handler but the .NET Extensibility Feature is not installed.
In my local enviroment it just works. Iam no IIS Admin so ....
i try the following
My domain "http://mysite.com/" goes to my url provided by my hosting service (discountasp.net)
I want that this url goes to the root/mysite/ virtual directory but i want that the url stays on "http://mysite.com/". So i defined the following rule, but it doesnt work for me.
here is my web.config that is placed in the root directory (generated by the IIS7 Remote Administration UI)
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>[code]....
I'm using the iis7 URL Rewrite module and it's working fine, except for two things. Being new to this, I might be missing something obvious.
1) My URL gets converted from www.mysite.com/search.aspx?fName=John&sName=Smith to www.mysite.com/John/Smith. This works fine, but if I add a trailing / , a few images on the site disappear, wheras a few don't. (They're all in the same location). However, the search results are fine.
2) Is it possible to make cerain querystrings optional? Server side, this is implemented (i.e. if nothing is entered, then assume a default value). But how would this work with the URL rewrite module? e.g. www.mysite.com/John would search for John and use a default value for the sName parameter.
I am using a project that rewrites URL. I am not familiar with this code, but it works fine on IIS 6 and with VS2010. Problem begins when I need to deploy into IIS7.5 server. Seems like the rewrite doesn't work and the page doesn't fount after rewriting page.
[Code]....
I am trying to use this web.config code, but then I could see this:
[Code]....
I've run into a strange problem regarding default buttons in master pages and IIS7 rewrite module. All my content pages have default buttons set in the code-behind (on prerender), or they are in panels on the aspx page. This works fine on my local machine and on the production server. However, when I enable IIS7 URL Rewrite, the default button is always to the one in the master page.
protected void LoginButton_PreRender(object sender, EventArgs e)
{
Button btnDefault = sender as Button;
this.Page.Form.DefaultButton = btnDefault.UniqueID;
}
That's how I set my default button in the code-behind. I'm not sure what the rewrite module could be doing.
I have a domain which is receiving quite a few hits per day and have been asked if I can serve the static content from a subdomain. As the site is quite extensive and already written, I was wondering if there is any way I can use URL rewriting to change:
www.example.com/image.gif
to
static.example.com/image.gif
I have a solution which works using 301 redirects but from what I understand, this is counter productive as 2 requests will have to be made per image. I don't really want to go through all the aspx pages and css to hard code the new url as it will cause problems further down the line - some parts of the site are still being developed and static content could change at any time. I tried using rewrite (as opposed to redirect) to change the url but it came out something like:
http://www.example.com/http://static.example.com/image.gif
How would you achieve this? I have full access to dns and the server (win 2008r2 / IIS 7.5) so can make any changes if url rewriting is not the answer.
is this something basic or am I missing something?My ASP.NET (4.0) site has a web.config with URL rewrite rules. When I run it in debug mode (local webserver) all the URLs fail because the local web server does not recognize the rules (e.g. I have /register which maps to register.aspx etc.)Is there someway I can get the debug system to recognize my URL rewrite rules? Should I be doing something else?
View 2 Replies