Groups | Blog | Home
all groups > iis security > september 2003 >

iis security : Redirecting to same server


David Crystal
9/12/2003 11:18:05 PM
I have a web interface for a document management system running on IIS5. It
installed itself under the Default Web Site. We have employed an SSL
certificate and now users must preface the URL with 'https' rather than
'http'. Is there any way to automatically redirect users to the same
website substituting https for http? I have tried this under the Virtual
Directory tab in Internet Services Manager and the result is an endless loop
in the browser when trying to connect. Is this occurring because I am using
the Default Website?

Any advice would be appreciated.

Tom Pepper Willett
9/13/2003 9:57:29 AM
SSL will not work with host headers.

[quoted text, click to view]
| In article <Nus8b.12$ZC7.8752313@newssvr13.news.prodigy.com>,
| dcrystal@chrismill.com says...
| > I have a web interface for a document management system running on IIS5.
It
| > installed itself under the Default Web Site. We have employed an SSL
| > certificate and now users must preface the URL with 'https' rather than
| > 'http'. Is there any way to automatically redirect users to the same
| > website substituting https for http? I have tried this under the
Virtual
| > Directory tab in Internet Services Manager and the result is an endless
loop
| > in the browser when trying to connect. Is this occurring because I am
using
| > the Default Website?
| >
| > Any advice would be appreciated.
|
| Yes, create the HTTPS site, if you don't have a fixed (separate) Ip for
| it you will have to use HOST HEADERS.
|
| Once you get the HTTPS site running, check to make sure it works before
| you do the redirect.
|
| REDIRECT: Open IIS, select the old site, (my example is a virtual
| directory, but it's the same for a root site) Select the "A redirection
| to a URL", enter HTTPS://yoursite.com and then click "The exact URL
| entered above" and the "A permanent redirection for this resource".
|
| It should work fine now.
|
| --
| --
| spamfree999@rrohio.com
| (Remove 999 to reply to me)

Leythos
9/13/2003 1:03:37 PM
In article <Nus8b.12$ZC7.8752313@newssvr13.news.prodigy.com>,
dcrystal@chrismill.com says...
[quoted text, click to view]

Yes, create the HTTPS site, if you don't have a fixed (separate) Ip for
it you will have to use HOST HEADERS.

Once you get the HTTPS site running, check to make sure it works before
you do the redirect.

REDIRECT: Open IIS, select the old site, (my example is a virtual
directory, but it's the same for a root site) Select the "A redirection
to a URL", enter HTTPS://yoursite.com and then click "The exact URL
entered above" and the "A permanent redirection for this resource".

It should work fine now.

--
--
spamfree999@rrohio.com
Leythos
9/13/2003 6:24:13 PM
In article <enuUXdgeDHA.1832@TK2MSFTNGP09.phx.gbl>, tompepper@mvps.org
says...
[quoted text, click to view]

Sorry, my bad - I missed the SSL part. I hope you have more than one IP
then.


--
--
spamfree999@rrohio.com
Karl Levinson [x y] mvp
9/14/2003 10:44:42 AM
Alternatively, you may want to create a blank new web site listening on port
TCP 80 with only one document, a default document like default.htm or
default.asp containing redirect script using something such as META REFRESH
[or the Response.Redirect https://yoursite.com script mentioned below] that
redirects anyone to the new site.

My worry in general about changing the 40x error pages is that they apply
globally and so might occur at certain times when you would not them to run.


[quoted text, click to view]

Ken Schaefer
9/14/2003 1:13:45 PM
I don't know if this will work, but you could try:

a) in the IIS MMC Snapin, set "SSL is required", so that plain http://
connections will be rejected.
b) create a custom 403.4 error handler (as an ASP page, set the type from
"default" to "URL", and enter /yourWebApp/403_4.asp or whatever you call
your ASP page. Have this page to a Response.Redirect() to the homepage of
your document management system, eg:

Response.Redirect("htt ps://myServer.com/myApp/")

Cheers
Ken


[quoted text, click to view]
: I have a web interface for a document management system running on IIS5.
It
: installed itself under the Default Web Site. We have employed an SSL
: certificate and now users must preface the URL with 'https' rather than
: 'http'. Is there any way to automatically redirect users to the same
: website substituting https for http? I have tried this under the Virtual
: Directory tab in Internet Services Manager and the result is an endless
loop
: in the browser when trying to connect. Is this occurring because I am
using
: the Default Website?
:
: Any advice would be appreciated.
:
:

Ken Schaefer
9/15/2003 11:41:57 AM
I don't think that'll doesn't help if the SSL site answers on the same
host-header name as the non-SSL site, since both of those "sites" need to
point to the same content folder on the server don't they?

ie, used to have a site:
http://myserver.com/myApp -> c:\inetpub\wwwroot\myApp
but now it needs to be accessed via SSL so:
https://myserver.com/myApp -> c:\inetpub\wwwroot\myApp

There isn't really an option to have:
http://myserver.com/myApp -> c:\inetpub\wwwroot\otherDirectory\ (which
contains the default.htm with a redirect_
and
https://myserver.com/myApp -> c:\inetpub\wwwroot\myApp

Cheers
Ken

[quoted text, click to view]
: Alternatively, you may want to create a blank new web site listening on
port
: TCP 80 with only one document, a default document like default.htm or
: default.asp containing redirect script using something such as META
REFRESH
: [or the Response.Redirect https://yoursite.com script mentioned below]
that
: redirects anyone to the new site.
:
: My worry in general about changing the 40x error pages is that they apply
: globally and so might occur at certain times when you would not them to
run.
:
:
[quoted text, click to view]
: > I don't know if this will work, but you could try:
: >
: > a) in the IIS MMC Snapin, set "SSL is required", so that plain http://
: > connections will be rejected.
: > b) create a custom 403.4 error handler (as an ASP page, set the type
from
: > "default" to "URL", and enter /yourWebApp/403_4.asp or whatever you call
: > your ASP page. Have this page to a Response.Redirect() to the homepage
of
: > your document management system, eg:
: >
: > Response.Redirect("htt ps://myServer.com/myApp/")
: >
: > Cheers
: > Ken
: >
: >
[quoted text, click to view]
: > : I have a web interface for a document management system running on
IIS5.
: > It
: > : installed itself under the Default Web Site. We have employed an SSL
: > : certificate and now users must preface the URL with 'https' rather
than
: > : 'http'. Is there any way to automatically redirect users to the same
: > : website substituting https for http? I have tried this under the
: Virtual
: > : Directory tab in Internet Services Manager and the result is an
endless
: > loop
: > : in the browser when trying to connect. Is this occurring because I am
: > using
: > : the Default Website?
: > :
: > : Any advice would be appreciated.
: > :
: > :
: >
: >
:
:

Paul Lynch
9/16/2003 9:07:46 PM
David,

You could try this :

How to automatically change from http to https for a specific folder
http://www.iisfaq.com/default.aspx?View=A407&P=20


Regards,

Paul Lynch
AddThis Social Bookmark Button