IIS HTTPS Enforcement (HTTP → HTTPS Redirect)

This mini-project demonstrates enforcing HTTPS on an IIS website by configuring an HTTP → HTTPS redirect using the IIS URL Rewrite Module. It covers installing URL Rewrite, creating an inbound rule, adding a condition to detect non-HTTPS traffic, applying a redirect action, and verifying the change in web.config.

Course: System & Network Administration (SNA Lab)
Tool Used: IIS Manager, URL Rewrite Module
Focus: HTTPS enforcement, URL Rewrite rules, redirect validation

---

Tools & Technologies

• Windows 11 (similar steps apply on Windows 10 / Windows Server)
• IIS (Internet Information Services)
• IIS URL Rewrite Module
• IIS Manager (URL Rewrite feature)
• web.config (rule verification)

---

Project Files

• report/ (lab report / documentation)
• assets/ (screenshots: rule creation, condition, action, verification)

---

What’s Demonstrated

• Installing the IIS URL Rewrite Module
• Creating an inbound rewrite rule (Blank rule)
• Redirect rule configuration:
  • Rule name example: HTTPSRedirect
  • Match URL pattern using regular expressions (.*) with ignore case
• Adding a condition to avoid redirect loops:
  • Condition input: HTTPS
  • Pattern: OFF
• Redirect action to force HTTPS while preserving host and URI:
  • https://{HTTP_HOST}{REQUEST_URI}
• Verifying the applied rule by checking the site web.config

---

Key Learning

• How to enforce HTTPS at the IIS layer using URL Rewrite
• Why the HTTPS=OFF condition is important to prevent infinite redirects
• How to confirm IIS rewrite rules using web.config inspection

---

Screenshots

Evidence is available in assets/:

• 01-url-rewrite-module-install.png
• 02-iis-url-rewrite-feature.png
• 03-add-inbound-blank-rule.png
• 04-https-off-condition.png
• 05-web-config-rule-verified.png

---

How to Run

1. Clone the repository:

git clone https://github.com/Sameed-333/iis-https-enforcement.git

2. Navigate to the project folder:

cd iis-https-enforcement

3. Review documentation and evidence:

• Open the report inside report/
• Review screenshots in assets/

4. Validate (high-level):

• Install URL Rewrite and create an inbound rule for HTTP → HTTPS redirection
• Add the HTTPS = OFF condition and configure redirect action
• Verify the rule is written into web.config
• Test the site URL in a browser and confirm HTTP requests redirect to HTTPS

---

Disclaimer

This project is for educational purposes only as part of a university SNA lab. It demonstrates HTTPS enforcement via IIS URL Rewrite in a controlled environment and is not intended as a complete production security baseline.