6

I am trying to force all traffic on my web site to use HTTPS, using the URL Rewrite 2.0 module added to IIS 7.5. I got that working and now have a need to exclude a couple of pages from using SSL. So I need a rule to rewrite all URL except those referencing this folder to HTTPS. I've been banging my head against the wall on this and am hoping someone can help. I tried creating a rule to match all URL except those in a nossl subfolder as in this example:

<rule name="HTTP to HTTPS redirect" enabled="true" stopProcessing="true">
  <match url="(/nossl/.*)" negate="true" />
  <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
        <add input="{HTTPS}" pattern="off" />
  </conditions>
  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" />
</rule>

But this doesn't work. Can anyone help?

Improve this question

3 Answers 3

Reset to default
9

If anyone is curious I resolved this problem with the following syntax:

<rule name="NoSSL - folder" enabled="true" stopProcessing="true">
   <match url="^nossl/.*" />
   <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
   </conditions>
   <action type="None" />
</rule>
<rule name="Redirect to HTTPS" enabled="true" stopProcessing="true">
    <match url="(.*)" />
    <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
        <add input="{HTTPS}" pattern="off" />
    </conditions>
    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" />
</rule>
Improve this answer
2
  • Brett, I was looking for this exact thing, so thanks! However it appears that this doesn't work if the user browsing the site is using anything but IE. Did you run into this and if so what was your resolution? Thanks
    – user16526
    Jun 25, 2012 at 12:36
  • Seth, this has worked perfectly for us for over a year now. We have seen no issues with any browsers. We are running IIS 7.5 on Server 2008 R2.
    – BrettRobi
    Jun 25, 2012 at 15:51
2

Although I'm a bit late to the party, I would like to suggest this syntax, which is a bit shorter (and IMHO cleaner) than the accepted one:

<rule name="Redirect to HTTPS except /nossl/ folder" enabled="true" stopProcessing="true">
    <match url="(.*)" />
    <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
        <add input="{REQUEST_URI}" url="^nossl/.*" negate="true" />
        <add input="{HTTPS}" pattern="off" />
    </conditions>
    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" />
</rule>
Improve this answer
2
  • I like the elegance of this solution, however, I get a 500 error when I try to implement it. The first <add input="{REWRITE_URI}... condition is what triggers the error.
    – Dave L
    Jan 6, 2020 at 20:57
  • 1
    @DaveL it should be {REQUEST_URI}: fixed the code snippet accordingly.
    – Darkseal
    Jan 7, 2020 at 1:49
1

Adding this condition <add input="{REQUEST_URI}" url="^nossl/.*" negate="true" /> resulted in a 500 Internal Server error. After reading the documentation a bit more I changed it to this and had a better result.

<rule name="Redirect to HTTPS except nossl folder" stopProcessing="true">
    <match url="(.*)" />
    <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
        <add input="{REQUEST_URI}" pattern="^nossl" matchType="Pattern" negate="true" />
        <add input="{HTTPS}" pattern="off" />
    </conditions>
    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" />
</rule>
Improve this answer
1
  • I believe the pattern should be more like the following to actually match URLs in the nossl folder pattern="^/nossl/.*"
    – dezdez
    Mar 4, 2020 at 1:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.