I'm trying to redirect all http traffic to https while returning 301 status code. For some reason, I get 307 status instead and I dont know why. I tried to search to see if I missed something in my config, but it's seem similar to everything I saw.
My web.config
<rewrite>
<rules>
<rule name="ForceWWW" stopProcessing="true">
<match url=".*" ignoreCase="true" />
<conditions>
<add input="{HTTP_HOST}" pattern="^MY_DOMAINE" />
</conditions>
<action type="Redirect" url="https://www.MY_DOMAINE/{R:0}" redirectType="Permanent" />
</rule>
<rule name="HTTP to HTTPS redirect" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="off" ignoreCase="true" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
</rule>
</rules>
<outboundRules>
<rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
<match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
<conditions>
<add input="{HTTPS}" pattern="on" ignoreCase="true" />
</conditions>
<action type="Rewrite" value="max-age=31536000" />
</rule>
</outboundRules>
</rewrite>
UPDATE
I just found something interesting. Exemple my domaine is domaine.com
If I search:
domaine.com the redirection is 301
http://www.domaine.com the redirection is 307
www.domaine.com the redirection is 307
UPDATE
I only got the problem with Chrome. Other browers have the 301 status with the redirection.
You specify the Strict_Transport_Security in the response, which activates HSTS
Chrome doesn't even call the server and redirects directly through a 307 http code. More info