Why does IIS 7.5 adds a trailing slash on folders? Can we disable courtesy redirect for a URL Rewrite rule that removes trailing slash?

Question

IIS does URL cleanup on directories by adding a trailing slash. See this old docs from IIS 6: IIS generates courtesy redirect when folder without trailing slash is requested

1. Why? Is the intent still relevant?
2. Any security implications?
3. How can I disable it to make this work with a URL Rewrite rule "RemoveTrailingSlashRule"

When you add a rule under IIS 7.5 with URL Rewrite 2, the rule will not be applied to directories (using IsDirectory) and folders (using IsFolder).

See this warning on Add a rule to append or remove the trailing slash symbol:

This will create the RemoveTrailingSlashRule1:

Ine

Sad to see there are no answers on this one. I'm running into it as well. Have you been able to find any workarounds or more information about this? – Finedraw

Sorry, been banging my head on this as well. I think the application is the problem, with IIS treating it similar to a website root requiring the trailing slash. I even tried a "scraping" page in the main website, that did a request/response from the sub site, but IIS seems to redirect before any rewrite rule has an effect, whether rules are at server or site level, whether IIS Rewrite or Helicon Ape, etc. – Pentamerous

Answer 1

I have an answer for the specific case of a child IIS Application here: https://mcmap.net/q/658301/-removing-the-trailing-slash-from-a-nested-application-39-s-virtual-directory-root-in-iis. The child app seems to be the usual culprit, but isn't explicitly described in this question.

To try to answer the questions, here are my opinions from dealing with IIS and Microsoft for years. I don't have hard sources to cite; some of this is just gut feelings.

1. Why? Is the intent still relevant?

I think it stemmed from the original "default document" feature, namely index.html. Websites wanted their home page to just be the domain, then this extended to subfolders. With url rewriting, the intent isn't relevant anymore - you can rewrite to your heart's content, and would rather IIS get out of the way. It's common to want friendly urls, and no trailing slash (except for the domain/website root - that is required to have a trailing slash, even if some browsers like Chrome get cute and hide it).

2. Any security implications?

I think the only security implication was the original directory browsing. If you forgot to do a default document, and directory browsing was left turned on, then people could browse your website files. As far as I know, directory browsing has been long disabled as the default setting.

With any requests, whether trailing slash or not, url rewriting or not, your server and code need to withstand bad requests. This is true for all situations, not just specific to the slashes. http://xkcd.com/327/

3. How can I disable it to make this work with a URL Rewrite rule "RemoveTrailingSlashRule"

I have an answer if the issue is the child application, here: https://mcmap.net/q/658301/-removing-the-trailing-slash-from-a-nested-application-39-s-virtual-directory-root-in-iis The summary is, in IIS:

• Disable the Default Document feature for the child application.
• Using Url Rewrite, create a rule to rewrite (not redirect) an empty request to default.aspx

If this question is for a more general issue, including regular subfolders even if not a child app, consider removing the "Is Not a Directory" from the rule, and let this redirect even when it sees a directory. That may work, or may create an infinite redirect loop, I'm not sure.

Pentamerous

Thanks for your insight. A valuable contribution for sure. – Gerianne

Answer 2

This saved us:

Blockquote If this question is for a more general issue, including regular subfolders even if not a child app, consider removing the "Is Not a Directory" from the rule, and let this redirect even when it sees a directory. That may work, or may create an infinite redirect loop, I'm not sure.

To help us indexing our Angular 17 SSR website in google, because It generates a folder with the same name as the route. Setting the

 <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="false" />

to false in combination of the rewrite rule did the trick

Maimonides