IIS7.5: Is there a way to use Require SSL and URL Rewrite Module together for https?
iis, iis-7.5, ssl, url-rewrite-module, url-rewriting
Solution
The 2 options work a very different way.
If you use the Require SSL option, every single page of your website has to be accessed by HTTPS and it means that (as you have seen it), if you forget the HTTPS and try to access with HTTP, you will have a 403 Unauthorized.
If you use the URL Rewrite Module, you can setup some pages or your whole website to be redirected to HTTPS (and some part back to HTTP if needed), and if a user forgets the HTTPS and hits the HTTP, he/she will be redirected to the HTTPS url.
As of having them to work together, there is a solution, but I don't really see the point:
[...] you will need to disable “Require SSL” checkbox for the web site. If you do not want to do that, then you can create two web sites in IIS – one with http binding and another with https binding – and then add this rule to the web.config file of the site with http binding.
http://blogs.iis.net/ruslany/archive/2009/04/08/10-url-rewriting-tips-and-tricks.aspx (Section `4. Redirect to HTTPS`)
Problem
In IIS7.5, I have a URL Rewrite rule that redirects http requests to https. If I check "Require SSL", I get a 403 Unauthorized instead of a redirect, which makes sense. Is there a way to use them together? Would there even be a benefit? I'm assuming no since every http request would be redirected, but I'm checking here in case I'm wrong. Is this secure?