19

I use Azure cloud with web app and my server side written on nodejs. When web app receive a http request I want to redirect the request to https I found the solution. I put that to my web.config file inside the rules tag

        <rule name="Force HTTPS" enabled="true">
          <match url="(.*)" ignoreCase="false" />
          <conditions>
            <add input="{HTTPS}" pattern="off" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="false" redirectType="Permanent" />
        </rule>

The problem is when I type in the browser "https://myURL.com" it redirect to main screen every thing ok, but when I change https to http "http://myURL.com" it redirect to https://myURL.com/" and add to the url "bin/www" according that the url looks like that "http://myURL.com/bin/www", the response is: page doesn't find.

The question is how to redirect a clear url without added data to the url?

Part of my web.config file:

<rewrite>
      <rules>
        <!-- Do not interfere with requests for node-inspector debugging -->
        <rule name="NodeInspector" patternSyntax="ECMAScript" stopProcessing="true">
          <match url="^bin/www\/debug[\/]?" />
        </rule>
        <!-- First we consider whether the incoming URL matches a physical file in the /public folder -->
        <rule name="StaticContent">
          <action type="Rewrite" url="public{REQUEST_URI}" />
        </rule>
        <!-- All other URLs are mapped to the node.js site entry point -->
        <rule name="DynamicContent">
          <conditions>
            <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="True" />
          </conditions>
          <action type="Rewrite" url="bin/www" />
        </rule>
        <!-- Redirect all traffic to SSL -->
         <rule name="Force HTTPS" enabled="true">
          <match url="(.*)" ignoreCase="false" />
          <conditions>
            <add input="{HTTPS}" pattern="off" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="false" redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
    <!-- 'bin' directory has no special meaning in node.js and apps can be placed in it -->
    <security>
      <requestFiltering>
        <hiddenSegments>
          <remove segment="bin" />
        </hiddenSegments>
      </requestFiltering>
    </security>

Thanks for answers, Michael.

1
  • 1
    I found the solution just cleared cookies of browser after that the bug was disappeared Sep 1, 2016 at 13:09

4 Answers 4

40

Go to Azure portal and open the overview page of the (Web) App Service you wanna set to HTTPS only. In the sidebar, under the Settings section, there is an option for TLS/SSL Settings.

On clicking it, you will get an option on the screen to set your app's protocol to HTTPS only. There isn't any need to manually add separate ruleset for this.

This works on every tier of App Service Plan including the 'F'-Series (free subscription).

TLS/SSL Settings Page

Note that, if you are adding any custom domain you also need to add corresponding SSL bindings, you can easily get them using LetsEncrypt or alike. If any of the custom hostnames for your app are missing SSL bindings, then:

When HTTPS Only is enabled clients accessing your app on those custom hostnames will see security warnings.

PS: I just saw that this question was asked about 3 years ago and that time maybe there was no direct option to do this. But even so, I'm posting my answer because on Google (as on February 2020) this question still ranks first among others regd. automatic HTTPS redirection in Azure.

2
  • It helped me.. @michael-horojanski you should select this as Accepted Answer if it helped you also..
    – Sachin
    Aug 11, 2021 at 14:12
  • So simple and so helpful. Thank you.
    – landrew
    Feb 1, 2022 at 17:09
11

As of November 2017, this is now a simple switch in the Azure Portal: "HTTPS Only", under Custom domains.

https://blogs.msdn.microsoft.com/benjaminperkins/2017/11/30/how-to-make-an-azure-app-service-https-only/

It's also very easy in ARM: “httpsOnly”: true

1
  • April 2023 it's under Configuration -> General Settings
    – Jakob
    Apr 26 at 12:44
8

There is also a free and open source extension for this.

  1. Go to your Web App settings sidebar, search for the "Extensions" tab and click on "Add".

Extension Tab

  1. Scroll down and find the extension Redirect HTTP to HTTPS by gregjhogan.

Add Extension

  1. Accept the terms.

Accept Terms

  1. Restart the Web App for the actions to take effect immediately.

  2. Done !

For further details on the implementation of this extension, check the source code on GitHub. The most important source file is the applicationhost.xdt.

Quote from GitHub (02-08-2017) (credits go to gregjhogan):

applicationhost.xdt

<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
    <location path="%XDT_SITENAME%" xdt:Transform="InsertIfMissing" xdt:Locator="Match(path)">
        <system.webServer xdt:Transform="InsertIfMissing">
            <rewrite xdt:Transform="InsertIfMissing">
                <rules xdt:Transform="InsertIfMissing" lockElements="clear">
                    <rule name="redirect HTTP to HTTPS" enabled="true" stopProcessing="true" lockItem="true">
                        <match url="(.*)" />
                        <conditions>
                            <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                            <add input="{WARMUP_REQUEST}" pattern="1" negate="true" />
                        </conditions>
                        <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="true" redirectType="Permanent" />
                    </rule>
                </rules>
            </rewrite>
        </system.webServer>
    </location>
</configuration>
2
  • This is great .. the Web.Config rewrite rule did NOT work for me, this did! Aug 13, 2017 at 21:50
  • 2
    This extension is no longer available in Azure. You can now go to Settings -> TLS/SSL settings and set HTTPS Only to ON. Nov 17, 2019 at 21:05
3

R:1 is a back-reference to the rule pattern. You append that to the url here:

url="https://{HTTP_HOST}/{R:1}" 

changing that into

url="https://{HTTP_HOST}" 

should result in a redirect to the https root.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.