I'm trying to set up an IIS URL Rewrite rule to match 403 responses as a result of someone attempting to browse to a directory when directory browsing is disabled. I want to then redirect them to the usual ASP.NET custom errors page I have defined for 404s.
Here's what I have at present:
<outboundRules>
<!-- By default, browsing a directory with no default resource will return 403 -->
<rule name="Directory browsing location">
<match serverVariable="RESPONSE_LOCATION" pattern="(.*)" />
<conditions>
<add input="{RESPONSE_STATUS}" pattern="^403" />
</conditions>
<action type="Rewrite" value="/Error/PageNotFound?aspxerrorpath={PATH_INFO}"/>
</rule>
<rule name="Directory browsing status code" patternSyntax="ExactMatch">
<match serverVariable="RESPONSE_STATUS" pattern="403" />
<action type="Rewrite" value="302" />
</rule>
</outboundRules>
My assumption is that it needs to be an outbound rule and that I need to rewrite both the status code and add the location response header, although the latter wouldn't exist anyway with the original 403 response.
Behaviour at the moment is... nothing. I'm still seeing 403s no matter how much tweaking I do. Any ideas out there?
Incidentally, no, there aren't any legit 403s on the site that would be swallowed as a result of this. I could also create inbound rules for each path that might result in the condition being met, but that's not very scalable.