urlrewrite in IIS vs replace http with https in global.asax
What is difference in security point of view, implementing https with IIS UrlRewrite and implementing https by replacing http with https in the URL in application start event of global.asax dotnet code.
URL rewrite get executed in the begin request event in IIS pipeline. There’s no apparent difference in security level when you redirect http to https.
When you enable SSL in IIS manager, http and https side-by-side is not supported because schannel will break it. So you may need to create another site to handle the http binding and implement https redirection. In this case, both of them should be safe.
