Skip to content

Merge to Live #37688

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wadepickett merged 1 commit into from
Sep 18, 2026
Merged

Merge to Live #37688

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 23 additions & 1 deletion aspnetcore/fundamentals/url-rewriting.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ description: Learn about URL rewriting and redirecting with URL rewriting middle
monikerRange: '>= aspnetcore-2.1'
ms.author: wpickett
ms.custom: sfi-image-nochange
ms.date: 08/17/2026
ms.date: 09/18/2026
uid: fundamentals/url-rewriting
---
# URL rewriting middleware in ASP.NET Core
Expand Down Expand Up @@ -147,6 +147,28 @@ In the replacement string, captured groups are injected into the string with the

Try `/redirect-rule/1234/5678` with the browser tools on the network tab.

#### Redirect rule safety

The middleware expands capture groups and variables in a replacement string and then interprets the result as the redirect destination. A broad capture such as `(.*)` isn't inherently unsafe when a trusted local prefix constrains the destination. A rule is unsafe when request-derived text can control the complete destination, construct the `scheme://` prefix, or determine the authority (host) of an absolute URI.

```csharp
// Unsafe: $1 can supply a complete redirect destination.
options.AddRedirect("legacy/(.*)", "$1");

// Safe: The trusted prefix keeps the destination within the app.
options.AddRedirect("legacy/(.*)", "/archive/$1");

// Safe: The scheme and authority are fixed.
options.AddRedirect("legacy/(.*)", "https://example.com/$1");

// Unsafe unless $1 is validated against an allow list of hosts.
options.AddRedirect("go/(.*)", "https://$1/path");
```

Use a fixed local prefix when redirecting within the app. For external redirects, use a fixed host or validate the host against an allow list. Imported IIS URL Rewrite and Apache `mod_rewrite` rules also expand back-references and variables. Importing a rule doesn't validate its resulting substitution, so review imported rules by the same criteria.

Depending on the API, imported-rule options, and replacement, the original query string might be preserved or appended to the destination. Include query parameters when reviewing whether request-derived data can affect a redirect. For more information about validating redirect destinations, see <xref:security/preventing-open-redirects>.

### URL redirect to a secure endpoint

Use <xref:Microsoft.AspNetCore.Rewrite.RewriteOptionsExtensions.AddRedirectToHttps*> to redirect HTTP requests to the same host and path using the HTTPS protocol. If the status code isn't supplied, the middleware defaults to *302 - Found*. If the port isn't supplied:
Expand Down
Loading