Forum Discussion

Nlepore_67643's avatar
Nlepore_67643
Icon for Nimbostratus rankNimbostratus
Jan 25, 2013

Having issues with redirect

I'm trying to redirect certin pages to https, based on URI in a class.

 

Looks to be working for the default.aspx page, but not the others.

 

 

 

 

when HTTP_REQUEST {

 

 

if {[HTTP::path] equals "/"}{

 

HTTP::redirect /default.aspx

 

} elseif {[class match [string tolower [HTTP::uri]] contains secured_uris]}{

 

HTTP::redirect https://[HTTP::host][HTTP::uri]

 

}

 

}

 

 

 

 

The class includes;

 

/default.aspx

 

/contact_us.aspx

 

 

is it because I'm doing the redirect first?

 

8 Replies

  • Arie's avatar
    Arie
    Icon for Altostratus rankAltostratus
    1. Any errors in the log?
    2. Redirecting based on a URI that contains /default.aspx is risky, is it is quite conceivable that you'll have a path like /products/default.aspx sooner or later.

       

      I'd recommend using "starts_with".

       

      In addition, I'd use HTTP::path instead of HTTP::uri to check the request, as there's always a risk that a developer (or .NET) includes a path in a query string.
    3. Is it really necessary to redirect from "/" to "/default.aspx"? From a web hosting perspective you'll want to avoid people visiting the default page of a folder by name.
    4. If you're redirecting the home page to HTTPS it would make sense to do that right away, rather than redirecting to /default.aspx on port 80 first and then to port 443.
    5. Instead of using HTTP::redirect you may want to consider using HTTP::respond with response code 301, since those are cached by clients and 302s are not. (Be sure to disable your own browser cache during development and troubleshooting, though!)
    6. What happens if you go directly to /default.aspx? Do you get redirected?
    7. What does Fiddler show?
  • Try this;

    
    when HTTP_REQUEST {
     if { [HTTP::path] equals "/" } {
      HTTP::redirect "http://[HTTP::host]/default.aspx"
     }
     elseif { [class match [string tolower [HTTP::uri]] starts_with secured_uris] } {
      HTTP::redirect "https://[HTTP::host][HTTP::uri]"
     }
    }
    
  • If that isn't the best way to write this, what is?

     

     

    when HTTP_REQUEST {

     

     

    if {[HTTP::path] equals "/"}{

     

    HTTP::respond 301 location https://[HTTP::path]

     

    } elseif {[class match [string tolower [HTTP::uri]] starts_with secured_uris]}{

     

    HTTP::respond 301 location https://[HTTP::host][HTTP::uri]

     

    }

     

    }
  • Looks good but I would add some white space around the brackets, enclose the redirect strings in quotes and use an uppercase L with Location, like so;

    
    when HTTP_REQUEST {
     if { [HTTP::path] equals "/" } {
      HTTP::respond 301 Location "https://[HTTP::path]"
     }
     elseif { [class match [string tolower [HTTP::uri]] starts_with secured_uris] } {
      HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]"
     }
    }
    
  • Seems to be still only securing the one page. Another in the "secured_uris" datagroup doesn't get redirected.
  • Arie's avatar
    Arie
    Icon for Altostratus rankAltostratus
    Posted By Nlepore on 01/28/2013 09:09 AM

     

    I got it figured out, thanks for you help.

     

    What was it?