Who is this article for?

Please Review Server Admin trying to install Please Review with http redirecting to https

Server access will be required to follow these steps.

With Please Review you may wish to host over https (secure) and have users accessing http (insecure) redirected to the https (secure) method. This article doesn't explain how to do this as this is outside the scope of the product support, but it does covers what you need to consider

This article is split into the following sections:

1. Hosted with SSL on the server
2. Hosted with SSL offloading

1. Hosted with SSL on the server

With PR there are various settings in the web.config that can be enabled when configuring PR to be hosted with SSL, If PR uses an integration with an eternal system where it loads from inside a browser, you will need to consider all the bits in green since the end 2019/start 2020, because of the SameSite policy that came into effect. 

Additionally, since v7.6.0 there are additional changes needed for this to work. Further Internet standards in 2024, mean that a CHIPS policy came into effect. More details on the background of this can be found here. The extra settings are explained in the Web.Config file of v7.6 here. 

The URL Rewrite module in IIS on the server needs to be installed. This is available here: URL Rewrite : The Official Microsoft IIS Site. This is used to rewrite the cookies as they are sent out to ensure they are marked as partitioned. Note that When installing this, this may interrupt the the application, logging all the users out. 

After the changes are made, it should look like this but note that this will error if you have not first installed the URL Rewrite module.

However, by making these changes the site will ONLY work over https. If you try and add a rewrite/redirect method to this site to listen on http and redirect to https, this likely to fail because of those change made to make it ONLY work over https.

You would need to find another way to redirect to it. One method might be to setup a duplicate PR site but over http, without those settings changed above, with the redirect added in. There may be easier ways to do this but if you wanted to do this, please see this guide, which is about creating different PR sites with different login methods but could be used in this scenario to create a second site: Configuring Please Review in multiple sites

2. Hosted with SSL Offloading

This is where the site is hosted over http on the server and the https part is added on another point in the network infrastructure. The instructions included the SameSite instructions should be considered in the first instance here: SameSite web standards change 2019/2020. You will also need consider the further considerations for the CHIPS changes since v7.6.0 too as covered above.