IIS Url Rewrite results in 403 Forbidden - html

UPDATE
After enabling direcorty listing it seems to have worked but now im running into another error.
Resource interpreted as Stylesheet but transferred with MIME type text/html
I'm trying to rewrite a URL to take content from the absolute directory.
Let's assume my URL was https://somesite.com/a <-- absolute path
This directory consist of files like index.html, contact.html and folders like css,js,img
But i want to access this directory with a URL like https://somesite.com/a/somename/index which should take me to https://somesite.com/a/index but it should also keep the parameter somename in the URL therefore redirecting is not an option, this is because i need to use the Referrer Url later onwards from backend code.
My Rule
<rule name="StoreRewrite" stopProcessing="true">
<match url="^a/([^/]+)/([^/]+)" />
<conditions>
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
</conditions>
<action type="Rewrite" url="a/{R:2}" />
</rule>
The above redirect works but it doesn't load the additional content inside the html files, like js,css files which are all relative to the html file.
The below error is show when i enter the url https://somesite.com/a/someprofile/contact
The page from a\contact is displayed but not its relative content.
The console is filled with this error
Failed to load resource: the server responded with a status of 403 (Forbidden)

Related

IIS Rewrite rule that recognizes Internet Explorer gets confused by Chrome sometimes

Our website does not support Internet Explorer and therefore we redirect all such users to a page with an appropriate message. This is done in web.config using this Rewrite rule:
<rule name="BlockIE" enabled="true" stopProcessing="true">
<match url="(.*)" />
<conditions logicalGrouping="MatchAll">
<add input="{HTTP_USER_AGENT}" pattern="(Trident|MSIE)" />
<add input="{URL}" negate="true" pattern="^/no-ie-support.html" />
</conditions>
<action type="Redirect" url="/no-ie-support.html" appendQueryString="false" />
</rule>
Unfortunately, some Chrome users are also redirected to this page and thus cannot use the website.
We are unable to reproduce the problem. I asked one of these users to type "my useragent" into his browser (Chrome), and he got this:
It looks to me like a perfectly ordinary Chrome useragent, and it does not contain the "(Trident|MSIE)" pattern.
Any ideas what could be wrong with our Rewrite rule (or these users) and how to solve it?

IIS Web.config file redirect rules stops working after adding more than 3 rules

Hoping someone can help, I have a redesigned a site recently and need to redirect some URL's. I find it easier doing this in the Web.config file in IIS and have the current rules setup. Any more rules after this will break all the redirects and I get errors that the site is being redirected to many times. I have set it so that the stopPorcessing is true so it shouldn't try and redirect more than it is asked to?
<rule name="New About us Redirect" stopProcessing="true"><match url="^(about-us.*)" /><action type="Redirect" url="http://www.mysite.co.uk/about.html" /></rule>
<rule name="New Rule meet-the-team" stopProcessing="TRUE"> <match url= "^(meet-the-team.*)"/> <action type="Redirect" url="http://www.mysite.co.uk.co.uk/team.html" /> </rule>
<rule name="New Rule it-solutions" stopProcessing="TRUE"> <match url= "^(solutions.*)"/> <action type="Redirect" url="http://www.mysite.co.uk/services.html" /> </rule>
Any help would be much appreciated.

Got SSL, now all requested files are blocked (mixed content)

I have clients who use HTML on their pages, that I provide. That HTML links to files on my server (JS, CSS, images, etc).Example of what I give them: <link type="text/css" rel="stylesheet" href="http://www.example.org/this.css" />
I just got an SSL, so my site is now https. However the HTML on their server, that I gave them, is still http when requesting files from my server.
Because of this, they are getting mixed content warnings and the content is blocked. Like this:
Mixed Content: The page at 'https://www.example.org/' was loaded over HTTPS, but requested an insecure stylesheet 'http://www.example.org/file.css'. This request has been blocked; the content must be served over HTTPS.
I can't have all of my clients change all of their links on all of their pages to "https" so that warning/blockage is prevented. That would be a nightmare.
My host is GoDaddy. My server is a Windows server, IIS: 7.0, ASP.Net Runtime Version: 4.0/4.5.
How can I resolve this on my end through web.config? My current rules are:
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="HTTP to HTTPS redirect" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="off" ignoreCase="true" />
</conditions>
<action type="Redirect" redirectType="Permanent" url="https://{HTTP_HOST}/{R:1}" />
</rule>
</rules>
</rewrite>
</system.webServer>
What I want to happen is have all outside http requests to my https server, to be allowed.
Thanks!
You can serve the site with a Content-Security-Policy: upgrade-insecure-requests header.
The upgrade-insecure-requests CSP directive can also be specified using a meta element:
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
The HTTP Content-Security-Policy (CSP) upgrade-insecure-requests directive instructs user agents to treat all of a site's insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for web sites with large numbers of insecure legacy URLs that need to be rewritten.
The upgrade-insecure-requests directive is supported in all current browsers.
Incidentally, the “The page at 'https://www.example.org/' was loaded over HTTPS, but requested an insecure stylesheet 'http://www.example.org/file.css'” message is not one that anybody would get by just having a <link…href="http://www.example.org/this.css" /> element in the HTML for their own site. The only way they would get that message is if they navigated directly to https://www.example.org/.

Azure custom 404 page

I have created a web application using Microsoft Azure and uploaded static html pages to the web application.
It works fine, however, I would like to set a custom 404 page. Where or how can I do this using the Azure portal ?
Just to be clear, this is not a visual studio project, it's just some static html files. I just want to tell azure to use my 404 page instead of the default text it displays when a page cannot be found.
EDIT
Please note, this has nothing to do with IIS. I dont even have a web.config file. I am simply hosting some static html files in Azure and want a custom 404 page. I have already made the 404.html page.
Seems like you have to add a web.config file in your root directory. This seems like a workaround, but doing that and adding the following code works:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<httpErrors errorMode="Custom" defaultResponseMode="ExecuteURL">
<remove statusCode="404" subStatusCode="-1" />
<error statusCode="404" path="/404.asp" responseMode="ExecuteURL" />
</httpErrors>
</system.webServer>
</configuration>
Follow these steps to configure a custom 404 page for a Azure Static Web App:
Create a file named staticwebapp.config.json in root page (same folder as starting page i.e. index.html)
put these lines inside it:
{
"responseOverrides": {
"404": {
"rewrite": "/404.html"
}
}
}
Put your custom 404 page in root or subfolder (in this example 404.html is in root folder)
After a lot of testing and research, it was found that using responseMode="ExecuteURL" would result in a correct redirect, but the browser would report 200 Status rather than a 404. To fix this we removed the "/" and changed to responseMode="File" based on insight from this post: web.config errors fail with responseMode="File"
We are just hosting a simple static HTML site, not a web app, and this code worked:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<customErrors defaultRedirect="404.html" mode="RemoteOnly">
<error statusCode="404" redirect="404.html" />
<error statusCode="500" redirect="500.html" />
</customErrors>
</system.web>
<system.webServer>
<httpErrors existingResponse="Replace" defaultResponseMode="File" errorMode="Custom">
<remove statusCode="404" />
<error statusCode="404" path="404.html" responseMode="File" />
<remove statusCode="500" />
<error statusCode="500" path="500.html" responseMode="File" />
</httpErrors>
</system.webServer>
</configuration>

Windows Azure Website and static html in Blob storage

So I have a .NET MVC app published in an Azure Website which should serve static html pages stored in a blob container when clicking on a corresponding hyperlink.
My questions are:
The way to access a blob in Azure is
https://blobtest.blob.core.windows.net/container/htmlpage1.html,
however the peculiar part is when I login into my Azure Site and the url is
something like:
http://azuretestwebapp.azurewebsites.net/user123 and if I click
on a hyperlink to my html blob it can't help but normally take me to
blob azure site (well of course). Therefore I am wondering if there
is a way to have a url similar to this:
http://azuretestwebapp.azurewebsites.net/user123/container/htmlpage1.html
considering that the html pages are stored elsewhere in Azure.
If this is not feasible using an Azure Website or by storing
static html pages in Blob, what would be a better approach?
Thank you in advance for your time.
You can modify your web.config for your site to forward requests for static pages to blob storage using a redirect rule. Then the static content will be stored in and served from blob storage.
Place the following in a file named web.config (or modify your existing web.config) and put the web.config in the folder site/wwwroot on your website, next to the site content.
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="static" stopProcessing="true">
<match url="static/(.*)" />
<action type="Rewrite" url="https://blobtest.blob.core.windows.net/static/{R:1}" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>
Better late than never. Azure Blob requires the host header to be set correctly also otherwise it'll 404.
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="static" stopProcessing="true">
<match url="static/(.*)" />
<action type="Rewrite" url="https://blobtest.blob.core.windows.net/static/{R:1}" />
<serverVariables>
<set name="HTTP_HOST" value="blobtest.blob.core.windows.net" />
</serverVariables>
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>
Please remember to Allow Server Variable {HTTP_HOST} in URL rewrite.
https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/setting-http-request-headers-and-iis-server-variables
You could also set this in applicationhost.config section.
<location path="Default Web Site">
<system.webServer>
<rewrite>
<allowedServerVariables>
<add name="HTTP_HOST" />
</allowedServerVariables>
</rewrite>
</system.webServer>
</location>