ASP.NET - How to Redirect from HTTP to HTTPS and specific origin by Web.config [CORS policy issue]

Question

I do redirect users from Http to Https by below configuration

<rewrite>
  <rules>
    <rule name="HTTP_TO_HTTPS" enabled="true" stopProcessing="true">
      <match url="(.*)"/>
      <conditions logicalGrouping="MatchAny">
        <add input="{HTTPS}" pattern="^OFF$"/>
      </conditions>
      <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" appendQueryString="false"/>
    </rule>
  </rules>
</rewrite>

it works as expected. But here is a problem that it only redirects to Https but not excepted origin. I mean

http://www.example.com to https://www.example.com

http://example.com to https://example.com

The above situation cause, users have different origins that the Cross-origin resource sharing (CORS) policy problem.

I want to redirect all users to https://example.com in order to avoid conflicted origins.

Does this answer your question? [asp.net mvc: How to redirect a non www to www and vice versa](https://stackoverflow.com/questions/3197319/asp-net-mvc-how-to-redirect-a-non-www-to-www-and-vice-versa) — A_kat, Dec 30 '19 at 12:00

score 5 · Accepted Answer · answered Jan 12 '20 at 12:13

5

You could use the rewrite module to remove the WWW part also

<rule name="Remove www" stopProcessing="true">
  <match url="(.*)" ignoreCase="true" />
  <conditions>
    <add input="{HTTP_HOST}" pattern="^www" />
  </conditions>
  <action type="Redirect" url="http://example.com/{R:0}" redirectType="Permanent" />
</rule>

answered Jan 12 '20 at 12:13

VDWWD

35,079
22
62
79

Thanks, I will test it soon – A Farmanbar Jan 12 '20 at 17:54

score 2 · Answer 2 · answered Jan 12 '20 at 04:20

By Adding Header Information in Web.config

Another fix we can do is that add some tags to our Web.config file.

<system.webServer>
      <httpProtocol>
        <customHeaders>
          <add name="Access-Control-Allow-Origin" value="*" />
          <add name="Access-Control-Allow-Headers" value="Content-Type" />
          <add name="Access-Control-Allow-Methods" value="GET,POST,PUT,DELETE,OPTIONS" />
         <add name="Access-Control-Allow-Credentials" value="true" />
        </customHeaders>
      </httpProtocol>
  </system.webServer>

Thank you , I will feedback – A Farmanbar Jan 12 '20 at 17:55 — A Farmanbar, Jan 12 '20 at 17:55

ASP.NET - How to Redirect from HTTP to HTTPS and specific origin by Web.config [CORS policy issue]

2 Answers2