http to https rewrite too many redirect loops IIS

Question

I have application which I have hosted in IIS 7.0. Where I have to make sure that it works only on HTTPS and not on HTTP so I have included below rule in my root config.

<rewrite>
        <rules>
            <rule name="HTTP to HTTPS redirect" stopProcessing="true">
              <match url="(.*)" />
              <conditions>
                <add input="{HTTPS}" pattern="off" />
              </conditions>
              <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}"   redirectType="Found" />
            </rule>
        </rules>
</rewrite> 

After adding this rule when i tried to access my application I get below error:

Page has resulted in too many redirects. Clearing your cookies for this site or allowing third-party cookies may fix the problem. If not, it is possibly a server configuration issue and not a problem with your computer. Here are some suggestions: Reload this web page later. Learn more about this problem.

Answer 1

My case, I needed to put like this:

<rewrite>
<rules>
    <rule name="HTTP to HTTPS redirect" stopProcessing="true">
      <match url="(.*)" ignoreCase="false" />
      <conditions logicalGrouping="MatchAny">
        <add input="{HTTP_X_FORWARDED_PROTO}" pattern="^http$" />
        <add input="{HTTPS}" pattern="on" />
      </conditions>
      <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}"   redirectType="Found" />
    </rule>
</rules>

Answer 2

Put below input condition:

<add input="{HTTPS}" pattern="on" /> 

Instead of:

<add input="{HTTPS}" pattern="off" />

Answer 3

Also as was mentioned by SNag we had a site that is sitting behind an ELB on Amazon. Attempting to apply a rewrite rule without the following input header was causing infinite redirects. This appears to be a result of needing the input type being HTTP_X_FORWARDED_PROTO as in the following: <add input="{HTTP_X_FORWARDED_PROTO}" pattern="^http$" ignoreCase="false" />.

From AWS documentation "Your application or website can use the protocol stored in the X-Forwarded-Proto request header to render a response that redirects to the appropriate URL." We are using the ELB with DNS entries to forward to the server with the site on it.

Answer 4

We have our ASP.NET application hosted on AWS with Elastic Load Balancing, and the rule in the question with the accepted answer did not work for us, and kept causing infinite redirects.

This is the rule that finally worked for us:

<rewrite>
   <rules>
      <rule name="HTTPS Rule behind AWS Elastic Load Balancer Rule" stopProcessing="true">
         <match url="^(.*)$" ignoreCase="false" />
         <conditions>
            <add input="{HTTP_X_FORWARDED_PROTO}" pattern="^http$" ignoreCase="false" />
         </conditions>
         <action type="Redirect" url="https://{SERVER_NAME}{URL}" redirectType="Found" />
      </rule>
   </rules>
</rewrite>

Answer 5

For IIS 10 (Windows Server 2016) I have followed instructions from here which generate a slightly different XML configuration for the rewrite:

<rewrite>
    <rules>
        <rule name="HTTP 2 HTTPS" patternSyntax="Wildcard" stopProcessing="true">
            <match url="*" />
            <conditions logicalGrouping="MatchAny">
                <add input="{HTTPS}" pattern="off" />
            </conditions>
            <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Found" />
        </rule>
    </rules>
</rewrite>

The pattern is off and the match is only *.