xml IIS7：HTTP->HTTPS 干净利落
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/46347/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
IIS7: HTTP->HTTPS Cleanly
提问by cpuguru
Is there a clean way to redirect all attempts to going to an HTTP:// version of a site to its HTTPS:// equivalent?
是否有一种干净的方法可以将所有尝试访问网站的 HTTP:// 版本重定向到其等效的 HTTPS:// 版本？
回答by toxaq
I think the cleanest way is as described here on IIS-aid.com. It's web.config only and so if you change server you don't have to remember all the steps you went through with the 403.4 custom error page or other special permissions, it just works.
我认为最干净的方法是在 IIS-aid.com 上描述的。它只是 web.config，因此如果您更改服务器，您不必记住您使用 403.4 自定义错误页面或其他特殊权限所经历的所有步骤，它就可以工作。
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="HTTP to HTTPS redirect" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="off" ignoreCase="true" />
</conditions>
<action type="Redirect" redirectType="Permanent" url="https://{HTTP_HOST}/{R:1}" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>
回答by ColacX
The most easy and clean solution I found was to
我发现的最简单、最干净的解决方案是
In SSL Settings -> require SSL
In Error Pages -> On 403.4 error -> Redirect to the HTTPS site
In Error Pages -> Edit Features Settings... -> Set Detailed errors for local requests and custom error pages for remote request
在 SSL 设置 -> 需要 SSL
在错误页面 -> 403.4 错误 -> 重定向到 HTTPS 站点
在错误页面 -> 编辑功能设置... -> 设置本地请求的详细错误和远程请求的自定义错误页面
The benefit is that it requires no extra lines of code. Downside is that it redirects you to an absolute url.
好处是它不需要额外的代码行。缺点是它会将您重定向到绝对网址。
回答by mika
A clean way changes only the URL scheme from http -> https and leaves everything else equivalent. It should be server-side so that there are no browser issues.
一种干净的方法仅更改 http -> https 中的 URL 方案，并保留其他所有内容。它应该是服务器端，以便没有浏览器问题。
JPPinto.com has Step-By-Step instructionson how this is done, except that they use javascript (HttpRedirect.htm) instead of a server-side redirect. For some reason, I couldn't get IE run the javascript if you have ‘Show friendly HTTP error messages' enabled, which is on by default. Another thing with the script is that redirection to path didn't work even in FF or Chrome. The script always redirects to root. (Maybe I have missed something, because it should redirect to path.)
JPPinto.com 有关于如何完成的分步说明，除了它们使用 javascript (HttpRedirect.htm) 而不是服务器端重定向。出于某种原因，如果您启用了“显示友好的 HTTP 错误消息”（默认情况下处于启用状态），我将无法让 IE 运行 javascript。该脚本的另一件事是，即使在 FF 或 Chrome 中，重定向到路径也不起作用。脚本总是重定向到 root。（也许我错过了一些东西，因为它应该重定向到路径。）
For these reasons I have used an ASP page for the redirect. The downside is of course that this requires classic ASP to be enabled on the server.
由于这些原因，我使用了 ASP 页面进行重定向。缺点当然是这需要在服务器上启用经典的 ASP。
OpsanBlog has an ASP script and instructionsthat work well with IIS6.
OpsanBlog 有一个适用于 IIS6的ASP 脚本和说明。
I've had a few issues using this method with IIS7. User interface issues mostly, since IIS7 makes it really easy to miss something.
我在 IIS7 中使用这种方法时遇到了一些问题。主要是用户界面问题，因为 IIS7 很容易遗漏某些东西。
- First, you need to install ASP as a web server role feature.
- Second, using a virtual directory didn't not work as expected in IIS7 and I didn't try to debug this. Instead, I put the file in the root folder of the site and used the url '/SSLRedirect.asp' in the 403.4 error page to reference it.
- Last, the most tricky part, you must NOT enforce SSL for SSLRedirect.asp. Otherwise you'll get an 403.4 error. To do this you pick the file in IIS7 'Content View', and switch to 'Features View' so that you can edit the SSL settings for the single file and disable 'Require SSL' checkbox.
- 首先，您需要将 ASP 安装为 Web 服务器角色功能。
- 其次，使用虚拟目录在 IIS7 中没有按预期工作，我没有尝试调试它。相反，我将该文件放在站点的根文件夹中，并使用 403.4 错误页面中的 url '/SSLRedirect.asp' 来引用它。
- 最后，最棘手的部分，您不能为 SSLRedirect.asp 强制执行 SSL。否则，您将收到 403.4 错误。为此，您在 IIS7 的“内容视图”中选择文件，然后切换到“功能视图”，以便您可以编辑单个文件的 SSL 设置并禁用“需要 SSL”复选框。
IIS manager should show the file name in the header.
IIS 管理器应在标题中显示文件名。
回答by Toolkit
Global.asax
全球.asax
protected void Application_BeginRequest()
{
if (!Context.Request.Url.AbsoluteUri.Contains("localhost") && !Context.Request.IsSecureConnection)
Response.Redirect(Context.Request.Url.ToString().Replace("http:", "https:"));
}
回答by Jean-Marc
I use classic asp (intranet) and on pages that requires login the logon include file does the redirect:
我使用经典的 asp（内联网），在需要登录的页面上，登录包含文件执行重定向：
if Request.ServerVariables("SERVER_PORT_SECURE") <> "1" or Request.ServerVariables("HTTPS") <> "on" then
Response.Redirect "https://" & Request.ServerVariables("SERVER_NAME") & Request.ServerVariables("URL")
end if
This of course does not include GET or POST data. So in effect it's a clean redirect to your secured page.
这当然不包括 GET 或 POST 数据。所以实际上它是一个干净的重定向到您的安全页面。
