Redirecting to HTTPS while keeping the specified port number

Question

I am using IIS 10.0.17763 and configured HSTS to redirect HTTP to HTTPS. It works fine going from port 80 to 443, but if is specify a different port it still redirects to 443 instead of the original port.

I entered HTTP://site.mydomain.com:8080 and expected it to go to HTTPS://site.mydomain.com:8080. Instead, it went to HTTPS://site.mydomain.com without the port number.

Is there a way to do this with HSTS alone or do I need to use IIS URL Rewrite rules?

Answer 1

The RFC document actually forbids any mapping from port 80 to non-443 port,

https://www.rfc-editor.org/rfc/rfc6797#section-8.3

if the URI contains an explicit port component of "80", then the UA MUST convert the port component to be "443", or

if the URI contains an explicit port component that is not equal to "80", the port component value MUST be preserved; otherwise,

So you don't have a choice but to use port 443.

In case you have multiple sites on port 443 and limited IP addresses, enable SNI (as modern web servers all natively support that).

Please only use standard ports and have both HSTS and URL rewrite rules in place. Those ensure best experience to your end users.