IIS rewrite Rule - forbidden errors

Question

I have placed below rewrite rule in IIS for SDL Web website to dis-allow SDL Web access using IP address.

  <rewrite>
<rules>
  <rule name="RequestBlockingRule1" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
    <match url="*" />
    <conditions logicalGrouping="MatchAny">
      <add input="{HTTP_HOST}" matchType="Pattern" pattern="dev.abctridion.com" ignoreCase="true" negate="true" />
    </conditions>
    <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
  </rule>
  <rule name="http to https" enabled="true" stopProcessing="true">
    <match url="^(.*)$" ignoreCase="false" negate="true" />
    <conditions logicalGrouping="MatchAny">
      <add input="{HTTP_HOST}" pattern="^localhost$" negate="true" />
    </conditions>
    <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" appendQueryString="false"  />
  </rule>
</rules>

After placing this, when SDL Web is accessed in browser, I am seeing errors in notification area.

When

The remote server returned an error: (403) Forbidden. at System.Net.HttpWebRequest.GetResponse() at System.Net.HttpWebRequest.GetResponse() at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)

In the browser console log, below error is logged.

Dashboard.aspx:11 Uncaught Error: Error: The remote server returned an error: (403) Forbidden. at Tridion.Sys.Net.WebRequest.Sys.Net.WebServiceProxy.onComplete (coreresource_v8.1.0.194.38_.js?sav=1&cnt=core:100) at eval (coreresource_v8.1.0.194.38_.js?sav=1&cnt=core:103) at nrWrapper (Dashboard.aspx:11)

I have verified Tridion Core logs, but could not see any information there. Can someone assist me in resolving this forbidden errors. I am using SDL Web 8.1.

Answer 1

This is addressed by making slight changes in first rule. It seems like Tridion uses nettcp localhost for certain operations in back-end. So the "localhost" should be excluded from blocking as highlighted in pattern attribute. Below is the updated re-write rule.

  <rule name="RequestBlockingRule1" enabled="true" patternSyntax="ECMAScript" stopProcessing="true">
    <match url="^(.*)$" />
    <conditions logicalGrouping="MatchAny" trackAllCaptures="false">
      <add input="{HTTP_HOST}" pattern="\b(dev.abctridion.com)|(localhost)\b" negate="true" />
    </conditions>
    <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
  </rule>
  <rule name="http to https" stopProcessing="true">
    <match url="^(.*)$" />
    <conditions logicalGrouping="MatchAny" trackAllCaptures="false">
      <add input="{HTTP_X_FORWARDED_PROTO}" pattern="^http$" />
    </conditions>
    <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" />
  </rule>