URL Rewrite HTTP to HTTPS but now backwards - iis

Question

I have the following UrlRewrite code to change from http to https in the url but now I need it to change from https back to http.
For example when I redirect back from the Account/Logon page to the homepage.
Here are my rewriting rules:
<rewrite>
<rules>
<rule name="RequiresHTTPS-Redirect" stopProcessing="true">
<match url="(.+)" />
<conditions>
<add input="{HTTPS}" pattern="off" />
<add input="{RequiresHTTPS:{R:1}}" pattern="(.+)" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{C:1}"
appendQueryString="true" redirectType="Found" />
</rule>
</rules>
<rewriteMaps>
<rewriteMap name="RequiresHTTPS">
<add key="Account/LogOn" value="Account/LogOn" />
</rewriteMap>
</rewriteMaps>
</rewrite>

Answer 1

Put the logic to redirect back to the non-https page in the login page itself. The problem with redirecting from https to http is that the browser is still going to initiate an ssl connection first to the https url before it can get the redirect, so it's somewhat pointless.

Answer 2

There's a couple of scenarios here:
1. All content is protected by web forms <authorization>:
Your users are hitting the logon page because they've browsed to a part of the site that is protected using the <authorization> element. If this is the case you'll have a return URL passed to you in the query string: ReturnUrl. You can redirect users back to whence they came without SSL using:
return Redirect("http://" + Request.Url.Host + returnUrl);
2. Users have to logon to enable additional features:
Your users are clicking on the Logon link to enable some extra functionality that is being trimmed out on your pages if they aren't logged in. For example being able to post forum messages or view premium content.
In this case you could track where they've been before landing on the logon page. This example is based on the template application that you get with Visual Studio 2010 when you create a new MVC3 application (which you may have used as a template for your project).
In that sample application every page uses a master page Site.Master. Site.Master does a Html.RenderPartial("LogOnUserControl") to render the logon link on every page. Open the LogOnUserControl.ascx and change the code that renders the logon ActionLink to:
else
{
if(!Request.RawUrl.Contains("/Account/LogOn"))
{
Session["WhereWasI"] = Request.Url.AbsoluteUri;
}
%>
[ <%: Html.ActionLink("Log On", "LogOn", "Account") %> ]
<%
}
What we're basically doing to tracking the page the user is on if they aren't logged in. Because the Logon link is also rendered on the logon page itself we need to exclude that, hence the if statement:
if(!Request.RawUrl.Contains("/Account/LogOn"))
Then in your AccountController.cs Logon postback action method you can return the user to where they were on the site but using http insteadof https::
I've also included the redirect to non-SSL should there be a returnUrl supplied by ASP.NET Forms Authentication:
public ActionResult LogOn(LogOnModel model, string returnUrl)
{
if (ModelState.IsValid)
{
if (MembershipService.ValidateUser(model.UserName, model.Password))
{
FormsService.SignIn(model.UserName, model.RememberMe);
if (Url.IsLocalUrl(returnUrl))
{
//
// 1. All content is protected by web forms `<authorization>`:
// If there was a return URL then go back there
//
if(!String.IsNullOrWhiteSpace(returnUrl))
{
return Redirect("http://" + Request.Url.Host + returnUrl);
}
}
else
{
//
// 2. Users have to logon to enable additional features:
//
if (Session["WhereWasI"] != null)
{
return Redirect(
Session["WhereWasI"].ToString().Replace("https", "http"));
}
return RedirectToAction("Index", "Home");
}
}
else
{
ModelState.AddModelError("",
"The user name or password provided is incorrect.");
}
}
// If we got this far, something failed, redisplay form
return View(model);
}
The example is maybe a bit simplistic but you should be able to get the general idea.