How to enable HSTS on IIS7 with .NET Framework 4.0 - iis-7

When I try to use this configuration in my web.config file:
<httpRedirect enabled="true" destination="https://www.domain.co.uk/"
httpResponseStatus="Permanent" />
<httpProtocol>
<customHeaders>
<remove name="X-Powered-By" />
</customHeaders>
</httpProtocol>
<rewrite>
<outboundRules>
<rule name="Remove RESPONSE_Server">
<match serverVariable="RESPONSE_Server" pattern=".+" />
<action type="Rewrite" value="" />
</rule>
</outboundRules>
</rewrite>
I got this error when browsing the web app:
HTTP Error 500.19 - Internal Server Error The requested page cannot be
accessed because the related configuration data for the page is
invalid.
How do I fix this?

Related

IIS ARR with wordpress not working from internet Error timeout

I have an IIS server in my network with a domain configured who based on some ARR rules on the web.config shows a wordpress that is installed with xaamp in other server in my network.
So when yo go to example.com it shows the wordpress that its in 192.168.110.104:8080
When I try to access to example.com from my network, seems like the rules works fine and the wordpress content it works properly but when I try to access to the domain example.com from the internet it shows a lot of errors as looks like it's trying to load 'internal resources' form internet? obviously it load without css styles, some images works, some not, so it's a mess.
Errors are timeout like this.
GET http://192.168.100.104:8080/wp-content/themes/astra/assets/css/minified/style.min.css?ver=2.4.4 net::ERR_CONNECTION_TIMED_OUT
In the wordpress I have configured the :
wordPress (URL) as http://192.168.100.104:8080
web url : http://192.168.100.104:8080
Maybe I have to place the domain there instead the local ip?
This is my web.config from the IIS
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<defaultDocument>
<files>
<add value="homepage.asp" />
</files>
</defaultDocument>
<cors enabled="true" failUnlistedOrigins="true">
<add origin="*">
<allowHeaders allowAllRequestedHeaders="true" />
</add>
</cors>
<rewrite>
<rules>
<rule name="ReverseProxyInboundRule1" stopProcessing="true">
<match url="(.*)" />
<action type="Rewrite" url="{C:1}://192.168.100.104:8080/{R:1}" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
<add input="{CACHE_URL}" pattern="^(https?)://" />
</conditions>
</rule>
</rules>
<outboundRules>
<rule name="ReverseProxyOutboundRule1" preCondition="ResponseIsHtml1">
<match filterByTags="A, Form, Img" pattern="^http(s)?://192.168.100.104:8080/(.*)" />
<action type="Rewrite" value="http{R:1}://example.com/{R:2}" />
</rule>
<preConditions>
<preCondition name="ResponseIsHtml1">
<add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
</preCondition>
</preConditions>
</outboundRules>
</rewrite>
<staticContent>
<clientCache cacheControlMode="NoControl" />
</staticContent>
<httpProtocol>
<customHeaders>
<add name="Access-Control-Allow-Origin" value="*" />
<add name="Access-Control-Allow-Methods" value="GET, PUT, POST, DELETE, HEAD, OPTIONS" />
<add name="Access-Control-Allow-Credentials" value="true" />
<add name="Access-Control-Allow-Headers" value="X-Requested-With, origin, content-type, accept" />
</customHeaders>
</httpProtocol>
</system.webServer>
</configuration>
Any ideas? thanks in advance!

HTTP to HTTPS redirect in IIS 8

https://testitnow.in/edgar is the website which is built on ASP. I configured auto redirect in IIS but still, if I type testitnow.in in the web browser I'm getting the following error - "403 - Forbidden: Access is denied.
You do not have permission to view this directory or page using the credentials that you supplied."
But if I type https://testitnow.in or www.testitnow.in it is redirecting to https://testitnow.in. Kindly help me to fix this issue.
Try to update your web.config
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<clear />
<rule name="Redirect to https" stopProcessing="true">
<match url=".*" />
<conditions>
<add input="{HTTPS}" pattern="off" ignoreCase="true" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" appendQueryString="false" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>

ASP.NET Core http 500 error

I have created a redirect rule in my web.config in order to redirect my website from http to https. I published my website on my staging and it was working perfectly. After some manipulation in my web.config, i published again my website and now i have a HTTP 500 error. I tried to undo those modification and set my web.config as it was and i still have that error. I tried everything as well as deleting my web.config and create a new one but it seems that the manipulation i did has crushed my staging and i am not able to make it work again.
This is my web.config before redirection:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.webServer>
<handlers>
<add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModule" resourceType="Unspecified"/>
</handlers>
<aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="false">
</aspNetCore>
</system.webServer>
</configuration>
This is what i added for redirecting my http to https and it was working perfectly.
<rewrite>
<rules>
<rule name="HTTP to HTTPS redirect" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="off" ignoreCase="true" />
</conditions>
<action type="Redirect" redirectType="Permanent" url="https://{HTTP_HOST}/{R:1}" />
</rule>
</rules>
</rewrite>
Then i made some manipulation and change the action input {HTTP_POST} to my domain name. While it is working locally, my staging is not working anymore and i tried to undo everything but i still have the HTTP 500. What should i do?

web.config :: redirect all except root/index.html (Azure, WordPress)

I have a Wordpress hosted on azure, that I have move from www.mydomain.com to old.mydomain.com,
on www.mydomain.com I make a new landing page that inform of what I want to inform and give a link to the "old" wordpress,
to avoid loosing seo (and keep wp info alive) I made the next web.config
<?xml version="1.0"?>
<configuration>
<system.webServer>
<httpRedirect enabled="true" destination="http://old.mydomain.com" httpResponseStatus="Permanent" />
</system.webServer>
<location path="www.mydomain.com">
<system.webServer>
<httpRedirect enabled="false" />
</system.webServer>
</location>
</configuration>
redirect works perfectly, but it also redirect me www.mydomain.com to old.mydomain.com
How can I do it in web.config this no-redirect-the-root ??
I have try also the :
<location path="index.html">
<system.webServer>
<httpRedirect enabled="false" />
</system.webServer>
</location>
but the result is the same, everything gets redirect to old.mydomain.com
You can try to use the Rewrite module of IIS, please consider the following configuration:
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="Root rule" stopProcessing="true">
<match url="^$" />
<action type="None" />
</rule>
<rule name="redirect rule" stopProcessing="true">
<match url="^(.*)$" />
<action type="Redirect" url="http://www.example.com/{R:0}" appendQueryString="true" redirectType="Permanent" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>

IE6 gzip bug and IIS7 URL Rewrite Module

We're running into the nasty sporadic IE6 bug where gzip compression enabled on js and css files makes things go bad (see Can i gzip-compress all my html content(pages) for example).
Therefore, what seems to be the best way to deal with this would be to use the URL Rewrite Module in IIS7/7.5 to check for requests from < IE6 and serve them uncompressed as per http://sebduggan.com/posts/ie6-gzip-bug-solved-using-isapi-rewrite.
I want to use the IIS7 Url Rewrite Module
Only the IIS7 Url Rewrite Module 2.0 RC supports rewriting headers
But the following results in a 500 error for the affected resources:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="IE56 Do not gzip js and css" stopProcessing="true">
<match url="\.(css|js)" />
<conditions>
<add input="{HTTP_USER_AGENT}" pattern="MSIE\ [56]" />
</conditions>
<action type="None" />
<serverVariables>
<set name="Accept-Encoding" value=".*" /> <!-- This is the problem line -->
</serverVariables>
</rule>
</rules>
</rewrite>
</system.webServer>
What to put in the Server Variable for Accept-Encoding? I've verified that this is the problem line (as everything else has been isolated and operates as required). I've tried everything I can think of and I'm beginning to think that there just isn't support for setting the Accept-Encoding header.
I've tried:
<set name="HTTP_ACCEPT_ENCODING" value=" " />
<set name="HTTP_ACCEPT_ENCODING" value=".*" />
<set name="HTTP_ACCEPT_ENCODING" value="0" />
Specifically, it results in a "HTTP/1.1 500 URL Rewrite Module Error."
Well, it turns out that for security reasons you need to explicitly allow whatever server variables you wish to modify in the applicationHost.config (see http://learn.iis.net/page.aspx/665/url-rewrite-module-20-configuration-reference#Allowed_Server_Variables_List).
Therefore, the following does the trick in the Web.config:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="IE56 Do not gzip js and css" stopProcessing="false">
<match url="\.(css|js)" />
<conditions>
<add input="{HTTP_USER_AGENT}" pattern="MSIE\ [56]" />
</conditions>
<action type="None" />
<serverVariables>
<set name="HTTP_ACCEPT_ENCODING" value="0" />
</serverVariables>
</rule>
</rules>
</rewrite>
</system.webServer>
As long as the applicationHost.config has:
<location path="www.site.com">
<system.webServer>
<rewrite>
<allowedServerVariables>
<add name="HTTP_ACCEPT_ENCODING" />
</allowedServerVariables>
</rewrite>
</system.webServer>
</location>
See http://www.andornot.com/about/developerblog/2009/11/ie6-gzip-bug-solved-using-iis7s-url.aspx for a blog post detailing everything.
EDIT: Added official documentation link.
EDIT: Added link to blog post summarizing.

Resources