Why does IE duplicate query parameters when redirecting from HTTP to HTTPS

Question

We are hosting a site on IIS, and we are requiring HTTPS requests, and I've run across an odd bug related to how internet explorer (IE) handles that URL redirect.

If the initial request is

http://my.domain.com/?param1=hello&param2=100

then IIS forces the request to be redirected to an HTTPS request, but the resulting request is

https://my.domain.com/?param1=hello&param2=100&param1=hello&param2=100

In other modern browsers, this is not the case and the request is redirected as expected.

We are using URL Rewrite to redirect requests to HTTPS

Has anyone else seen this before, and is there anything that can be done to fix it?

Since you are using HandleNonHttpsRequest, please refer to this thread to override the HandleNonHttpsRequest method, in this method, you could set a break point to check the url, if it contains duplicate query parameters, you could rewrite the url. — Zhi Lv
– Zhi Lv, Commented Jun 12, 2019 at 2:25
@ZhiLv-MSFT I realized this morning that we have code in ASP.NET to handle this, but it is never getting hit because we ended up handling the HTTPS redirect using IIS URL Rewrite. — TJR
– TJR, Commented Jun 12, 2019 at 13:32

Campbeln · Accepted Answer · 2019-10-14 10:37:53Z

7

After realizing that the redirect was occurring in IIS, I was looking at settings in the rewrite action and noticed that the check box Append query string was checked. After unchecking that box, it appears to have resolved the issue. Query strings are still present in the redirect, but they aren't being duplicated now in IE.

The setting can also be changed in xml of the web.config by adding appendQueryString = "false" to the <action> child.

In the web.config file before making the change, there was nothing explicitly specifying the state of appendQueryString, so it is important to note that it seems that the default behavior of a redirect action is to append the query string.

To change the setting in IIS:

Open IIS Manager.
Select [Web Site With Issue].
In the Feature View, click "URL Rewrite".
Select "HTTP/S to HTTP Redirect" Rule and click "Inbound Rules > Edit" at right
Scroll down to nearly the bottom of the editor pane to "Action > Append Query String" checkbox and uncheck it.
Click "Apply" at right.

(Pretty pictures of most of this procedure here)

edited Oct 14, 2019 at 10:37

Campbeln

3,0103 gold badges35 silver badges34 bronze badges

answered Jun 12, 2019 at 15:38

TJR

3,8321 gold badge23 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Campbeln Over a year ago

Thanks for this solution! Seems very few people has run into this particular idiosyncratic behavior of IIS.

Collectives™ on Stack Overflow

Why does IE duplicate query parameters when redirecting from HTTP to HTTPS

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related