IIS URL Redirect HTTP to HTTPS excluding one or more folders

Ryan

6 years ago

If you've stumbled upon this post, it most likely means that you're trying to use the rewrite/redirect features of IIS to redirect all the HTTP requests coming to your website to HTTPS/SSL. Since you are here we'll also took for granted that you're working with the IIS URL Rewrite module (in case you don't know what it is or if you need help installing it, check out this other post).

To get straight to the point, here's the rewrite rule you're probably looking for:

<system.webServer>
    <rewrite>
        <rules>
            <rule name="Redirect to HTTPS" enabled="true" stopProcessing="true">
                <match url="(.*)" />
                <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                    <add input="{HTTPS}" pattern="off" />
                </conditions>
                <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" />
            </rule>
        </rules>
    </rewrite>
</system.webServer>

<system.webServer>

<rules>

</conditions>

</rule>

</rules>

</rewrite>

</system.webServer>

Now, what if we want to keep one or more folders (and all their contents) accessible through HTTP?

Here's a nice way to create an exception to the above rule adding a single additional line:

<system.webServer>
    <rewrite>
        <rules>
            <rule name="Redirect to HTTPS except /nossl/ folder" enabled="true" stopProcessing="true">
                <match url="(.*)" />
                <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                    <add input="{REQUEST_URI}" pattern="^nossl/.*" negate="true" />
                    <add input="{HTTPS}" pattern="off" />
                </conditions>
                <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found" />
            </rule>
        </rules>
    </rewrite>
</system.webServer>

<system.webServer>

<rules>

</conditions>

</rule>

</rules>

</rewrite>

</system.webServer>

As we can see, we took advantage of the negate="true" attribute to create an excluding input pattern, which - if matched - will prevent that rule from triggering: therefore, all the pages included in that folder will be accessible without SSL. Needless to say, you can add multiple input patterns to exclude additional folders from the HTTP-to-HTTPS mandatory redirect as well.

Pretty neat, right?

For additional info, check out the following IIS URL Rewrite Module resources by Microsoft:

Using URL Rewrite Module 2.0 (including docs, guides, tutorials & samples)
URL Rewrite Module - Video Walkthrough
URL Rewrite Module - Community Forum
URL Rewrite Module - Download Page

That's it for now: I hope that this could help other IIS administrators that are struggling against this issue!

Print Friendly & PDF Download