How to configure a redirect using the IIS URL Rewrite module

What is the IIS URL Rewrite module?

The IIS URL Rewrite module is a tool used to convert complex web addresses into consistent, memorable, URL's. The rewrite module produces URLs which are simple for users to remember and for search engines to find.

The rewrite module is based on HTTP headers and IIS server variables. It performs redirects, sends custom responses, or stops HTTP requests based on the logic expressed in the rewrite rules. Access to web site content is controlled by URL segments or metadata.

More information on the IIS URL Rewrite module and its features can be found here.

Using the IIS URL Rewrite module for more security

The URL rewrite module can also be used to reduce information disclosure in IIS:

Blocking requests without a host header using the URL rewrite module

HTTP version 1.0 request to the server (for any URI) without the Host header set will cause the server to reveal its internal IP address.

This vulnerability is known as Client Access Server Information Disclosure. The issue applies to IIS after 6.0 and before 10.0. You can find more information in this external article: https://www.cyberis.co.uk/blog/cas_info_disclosure.html

1. Open IIS Manager and click on your Dashboard Serverinstance.

   

2. In the main panel, double-click on URL Rewrite.

   

3. Click on Add rule(s) in the Actions panel on the right hand side.

   

4. Choose Inbound rules > Request blocking.

   

5. Enter the following settings for the rule:

   Block access based on: Host Header

   Block request that: Does not match the pattern

   Pattern (Host Header): .+
   (read: "dot plus", meaning "match one or more of any characters")

   Using: Regular Expressions

   How to block: Abort request

6. Click OK to save the rule.

   You can now see the rule in the URL rewrite module. Connections made via HTTP 1.0 without a Host header will now be rejected by the server.

Removing HTTP response headers using the URL rewrite module

There are 3 response headers you should remove for security reasons:

• Server - Specifies web server version

• X-Powered-By - Indicates that the website is "powered by ASP.NET."

• X-AspNet-Version - Specifies the version of ASP.NET used

Note: This method does not remove the header itself, but removes the value of it.

You can find other methods of removing the headers and more details about this security issue in this external article: https://techcommunity.microsoft.com/t5/iis-support-blog/remove-unwanted-http-response-headers/ba-p/369710

1. Open IIS Manager and click on your Dashboard Server instance.

   

2. In the main panel, double-click on URL Rewrite.

   

3. Click on View Server Variables in the Actions panel on the right hand side.

   

4. Click the Add button in the Actions panel.

5. Add 3 new variables, one for each header you want to remove:

   RESPONSE_SERVER for removing the Server header

   RESPONSE_X-POWERED-BY for removing the X-Powered-By header

   RESPONSE_X-ASPNET-VERSION for removing the X-AspNet-Version header

   You can see the newly created server variables in the list of allowed variables.

   

6. Click the Back to rules button in the Actions panel.

7. Click the Add rule(s) button in the Actions panel.

8. Create 3 new rules, one for each header you want to remove. Choose Outbound rules > Blank rule for each rule.

   

9. Enter the following settings for each rule:

   Name: Give the rule a name, for example "Remove Server Header"

   Precondition: None

   Matching scope: Server Variable

   Variable name: RESPONSE_SERVER
   (use RESPONSE_X-POWERED-BY and RESPONSE_X-ASPNET-VERSION for your other two rules)

   Variable value: Matches the pattern

   Using: Regular Expressions

   Pattern: .*
   (read "dot asterisk", meaning "match any content")

   Action type: Rewrite

   Leave the other settings to default.

10. Click the Apply button in the Actions panel.

Prerequisites

• Ensure that you are using IIS 7 or above.
• The IIS URL Rewrite module is installed during the Dashboard Server setup, if it not already installed. Alternatively, you can download IIS URL Rewrite module version 2 from Microsoft here. Close and re-open IIS to ensure that the IIS URL Rewrite module loads.

Instructions for configuring useful redirects

Configuring a redirect to switch traffic from the root to a Dashboard Server instance

Configuring a redirect to switch traffic from HTTP to HTTPS

How to redirect Open Access dashboards following a side-by-side upgrade to v5

Configuring a redirect to switch traffic from the root to a Dashboard Server instance

You can redirect traffic that goes to the root URL to go directly to your Dashboard Server instance to make the URL shorter and easier to use. For example, instead of having to use https://mywebsite.com/squaredupv5, your users would just have to enter https://mywebsite.com to reach Dashboard Server.

1. Open IIS Manager and click on Default Website

   

2. In the main panel, double-click on URL Rewrite.

   

3. Click Add Rule(s)... on the right-hand menu.

   

4. With Blank rule selected click OK.

5. Give the rule a name, such as 'Root Hit Redirect'.

6. In the Match URL section copy the following regex into the Pattern box:

   Copy

   ^$

   this asserts position at the start and end of the string entered.

7. In the Action section change the Action type from Rewrite to Redirect.
   
   

8. Copy the following into the Redirect URL box:

   Copy

   /squaredupv5

   where squaredupv5 is the application name of your Dashboard Server instance. If you are running Dashboard Server v4 this should be SquaredUpv4

9. Change the Redirect type from Permanent (301) to Found (302). We recommend the use of a 302 temporary redirect. Do NOT use 301 which is a permanent redirect and difficult to change at a later date.

10. Ensure Append query string is ticked. This is will add either /SquaredUpv4 or /SquaredUpv5  to the URL and redirect the user to their dashboard.

11. The Inbound Rule should look like this:

    

12. Click Apply on the right-hand menu under Actions.

    

Configuring a redirect to switch traffic from HTTP to HTTPS

For more information about SSL/TLS and HTTPS see How to configure TLS/SSL (HTTPS)

To redirect all HTTP requests to HTTPS use the following steps:

1. Open IIS Manager and click on the website that hosts the Dashboard Server instance (on Azure this is usually SquaredUpv4 or SquaredUpv5).

   

2. In the main panel, double-click on URL Rewrite.

   

3. Click Add Rule(s)... on the right-hand menu.

   

4. With Blank rule selected click OK.

5. Give the rule a name, such as 'Redirect to HTTPS'.

6. Copy the following and paste into the Pattern box in the Match URL section:

   Copy

   (.*)

   

7. Click to expand the Conditions section.

8. Click Add… to add a new condition to the configuration.

9. Copy the following and paste into the Condition input box :

   Copy

   {HTTPS}

   
   

10. Copy the following and paste into the the Pattern box:

    Copy

    ^OFF$

    
    

    

11. Click OK.

12. Scroll down and in the Action section

13. In the Action section change the Action type from Rewrite to Redirect.

    

14. Copy the following and paste into the Redirect URL box:

    Copy

    https://{HTTP_HOST}/{R:1}

15. Change the Redirect type from Permanent (301) to See Other (303).

    

16. Click Apply on the right-hand menu under Actions.

    
    

17. Click Back to Rules.

18. If you have other redirects configured you should ensure that you move your Redirect to HTTPS redirect to be listed first as shown in the image below. You can do this using the Move Up and Move Down options on the right.

How to redirect Open Access dashboards following a side-by-side upgrade to v5

When you run Dashboard Server v4 and v5 side-by-side, you can redirect your v4 Open Access links to the v5 Open Access dashboards. This way, users can get the benefits of Open Access on v5, such as the ability to hover over data to get more information.

This redirect only works as long as the v4 application pool is running and Dashboard Server v4 is installed. If you remove Dashboard Server v4 version, you need to use the new v5 links to access the dashboards.

When upgrading from Dashboard Server v4 to v5 the Open Access dashboard IDs remain the same, which is why you can redirect the old v4 Open Access URLs to the new v5 Open Access URLs using the IIS URL Rewrite module .

Configuring a redirect to switch traffic from v4 to v5 Open Access dashboards

These instructions apply to the default installation configuration where Dashboard Server is installed to an application underneath a website. If you have a different configuration please contact SquaredUp Support.

1. Open IIS Manager and click on the SquaredUpv4 application (you may have used a different name at installation).

   

2. In the main panel, double-click on URL Rewrite.

   

3. Click Add Rule(s)... on the right-hand menu.

   

4. With Blank rule selected click OK.
5. Give the rule a name, such as 'Open Access Redirect'.

6. In the Match URL section copy the following regex into the Pattern box:

   Copy

   (OpenAccess\/)([a-z0-9]{10}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})

7. The regex Pattern value matches the OpenAccess/[Open Access ID GUID] call that is made by the browser when first opening an Open Access dashboard.

   

8. In the Action section change the Action type from Rewrite to Redirect.

   

9. Copy the following into the Redirect URL box:

   Copy

   /squaredupv5/openaccess/{R:2}

   /squaredupv5/openaccess/{R:2}

   where squaredupv5 is the application name of your v5 instance.

   

10. Change the Redirect type from Permanent (301) to Temporary (307). A Temporary redirect is preferred as it doesn't allow the HTTP Method to be changed as part of the redirect, and it is well supported by different browsers.

    

11. The Inbound Rule should look like this:

    Pattern: (OpenAccess\/)([a-z0-9]{10}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})
    Action Type: Redirect
    Redirect URL: /squaredupv5/openaccess/{R:2}
    Redirect type: Temporary (307)

    

12. Click Apply on the right-hand menu under Actions.

    

13. With the redirect rule now in place. To updates wallboards to show the v5 Open Access dashboards the page should be manually refreshed, or the wallboard rebooted if that is easier. Any old Open Access links that have been emailed or saved should redirect when they are clicked.

The redirect will no longer work when the v4 application pool is stopped, or Dashboard Server v4 is removed.