8

I have this rule, to redirect all HTTP traffic to HTTPS:

<rewrite>
    <rules>
        <rule name="RedirectToHttps" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
            <match url="*" negate="false" />
            <conditions logicalGrouping="MatchAny">
                <add input="{HTTPS}" pattern="off" />
            </conditions>
            <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Found" />
        </rule>
    </rules>
</rewrite>

I found it on the Internet.

It works fine for simple URLs without query strings. But it duplicates query strings. For example http://example.com/path?key=value becomes https://example.com/path?key=value&key=value.

This causes problems in debugging and troubleshooting. What causes this behavior?

mohammad rostami siahgeli
  • 6,787
  • 9
  • 49
  • 89

1 Answers1

16

Problem is that variable REQUEST_URI contains URL and query string. In your case you have two solutions:

1) Add attribute appendQueryString="false" to your action. Rule should be like that:

.

<rule name="RedirectToHttps" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
    <match url="*" negate="false" />
    <conditions logicalGrouping="MatchAny">
        <add input="{HTTPS}" pattern="off" />
    </conditions>
    <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" appendQueryString="false" redirectType="Found" />
</rule>

2) Instead REQUEST_URI you can use URL variable because this variable contains only URL without the query string. The rule should be like that:

.

<rule name="RedirectToHttps" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
    <match url="*" negate="false" />
    <conditions logicalGrouping="MatchAny">
        <add input="{HTTPS}" pattern="off" />
    </conditions>
    <action type="Redirect" url="https://{HTTP_HOST}{URL}" redirectType="Found" />
</rule>
Victor Leontyev
  • 8,488
  • 2
  • 16
  • 36
  • 3
    It's worth noting that I think the official MS docs on this page are wrong: https://learn.microsoft.com/en-us/iis/web-dev-reference/server-variables It states that `REQUEST_URI` is "The path-absolute part of the URI. For example `https://contoso.com:8042/over/there?name=ferret` would return `/over/there`" This answer is correct. `REQUEST_URI` contains the querystring. – theyetiman Jul 13 '20 at 09:04