<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <defaultDocument>
            <files>
                <add value="products.asp" />
            </files>
        </defaultDocument>
        <httpErrors errorMode="DetailedLocalOnly">
            <remove statusCode="404" subStatusCode="-1" />
            <error statusCode="404" prefixLanguageFilePath="" path="/products.asp?page=404" responseMode="ExecuteURL" />
        </httpErrors>
        <rewrite>
            <rules>
                <rule name="Redirect non-www to www" stopProcessing="true">
                  <match url=".*" />
                  <conditions>
                    <add input="{HTTP_HOST}" pattern="^www\.(.*)$" negate="true" />
                    <add input="{HTTP_HOST}" pattern="^dev\.(.*)$" negate="true" />
                    <add input="{HTTP_HOST}" pattern="^dev-(.*)\.(.*)$" negate="true" />                    
                    <add input="{HTTP_HOST}" pattern="^secure\.(.*)$" negate="true" /> 
                  </conditions>
                  <action type="Redirect" url="https://www.{HTTP_HOST}/{R:0}" redirectType="Permanent" />
                </rule>   
                <rule name="HTTP to HTTPS redirect" stopProcessing="true">
                  <match url="(.*)" />
                  <conditions>
                    <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                  </conditions>
                  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
                </rule>
                <rule name="Rewrite sitemap.xml to google-sitemap.asp" patternSyntax="ExactMatch" stopProcessing="true">
                    <match url="sitemap.xml" />
                    <action type="Rewrite" url="google-sitemap.asp" appendQueryString="false" />
                </rule>
                <rule name="Rewrite sitemap.htm to products.asp?page=sitemap" patternSyntax="ExactMatch" stopProcessing="true">
                    <match url="sitemap.htm" />
                    <action type="Rewrite" url="products.asp?page=sitemap" appendQueryString="false" />
                </rule>
                <rule name="Redirect RCMF slash s (1)" stopProcessing="true">                  
                    <match url="^s/(.*)$" ignoreCase="false" />
                    <action type="Redirect" redirectType="Permanent" url="http://www.hyperflight.co.uk/{R:1}" />
                </rule>                 
                <rule name="Redirect RCMF slash s (2)" patternSyntax="ExactMatch" stopProcessing="true">                  
                    <match url="s" ignoreCase="false" />
                    <action type="Redirect" redirectType="Permanent" url="http://www.hyperflight.co.uk" />
                </rule> 
                <rule name="Rewrite for callback from Payzone" patternSyntax="ExactMatch" stopProcessing="true">
                    <match url="checkout/callback/payzone" />
                    <action type="Redirect" url="products.asp?cmd=checkout&amp;stage=co&amp;pt=PAYZONE" redirectType="Temporary" />
                </rule>
            </rules>
 
            <outboundRules>         
  
              <!-- Remove Pragma for all ASP pages -->
              <!-- (SS,09/11/25) for PCI compliance, i.e. the no-cache added by dbfunctions.asp DisableCache routine -->
              <rule name="Remove Pragma for ASP" enabled="true">
                <match serverVariable="RESPONSE_Pragma" pattern=".*" />
                <conditions>
                  <add input="{URL}" pattern="\.asp(?:$|\?)" ignoreCase="true" />
                </conditions>
                <action type="Rewrite" value="" />
              </rule>

            
              <!-- COOKIE FLAGS FIRST  (because of stopProcessing="true" for .asp rules) -->
              
              <!-- (SS,8/11/25) check and add cookie flags, already had SameSite=None -->
              <rule name="Add HttpOnly Cookie Flag" preCondition="No HttpOnly">
                  <match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" />
                  <action type="Rewrite" value="{R:0}; HttpOnly" />
                  <conditions>
                  </conditions>
              </rule>
              <rule name="Add Secure Cookie Flag" preCondition="No Secure">
                  <match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" />
                  <action type="Rewrite" value="{R:0}; Secure" />
                  <conditions>
                  </conditions>
              </rule>    
              <rule name="Add SameSite Cookie Flag" preCondition="No SameSite">
                  <match serverVariable="RESPONSE_Set-Cookie" pattern=".*" />
                  <action type="Rewrite" value="{R:0}; SameSite=None" />
              </rule>
              
             <preConditions>
                  <preCondition name="No HttpOnly">
                      <add input="{RESPONSE_Set_Cookie}" pattern="." />
                      <add input="{RESPONSE_Set_Cookie}" ignoreCase="true" pattern=";\s*HttpOnly" negate="true" />
                  </preCondition>
                  <preCondition name="No Secure">
                      <add input="{RESPONSE_Set_Cookie}" pattern="." />
                      <add input="{RESPONSE_Set_Cookie}" ignoreCase="true" pattern=";\s*Secure" negate="true" />
                  </preCondition>
                  <preCondition name="No SameSite">
                      <add input="{RESPONSE_Set_Cookie}" pattern="." />
                      <add input="{RESPONSE_Set_Cookie}" ignoreCase="true" pattern=";\s*SameSite" negate="true" />
                  </preCondition>             
              </preConditions>                 

              <!-- (SS,8/11/25) PCI no-cache for all .asp except getfile/getpic -->
              <rule name="Cache 7d for getfile/getpic" enabled="true" stopProcessing="true">
                <match serverVariable="RESPONSE_Cache-Control" pattern=".*" />
                <conditions>
                  <add input="{URL}" pattern="^/(?:getfile|getpic)\.asp(?:$|\?)" ignoreCase="true" />
                </conditions>
                <action type="Rewrite" value="public, max-age=604800, immutable" />
              </rule>
              
              <!-- (SS,8/11/25) no cache for all other .asp files, also added max-age=0, must-revalidate,  no-store, private for PCI compliance -->
              <rule name="PCI no-cache other ASP" enabled="true" stopProcessing="true">
                <match serverVariable="RESPONSE_Cache-Control" pattern=".*" />
                <conditions logicalGrouping="MatchAll">
                  <add input="{URL}" pattern="\.asp(?:$|\?)" ignoreCase="true" />
                  <add input="{URL}" pattern="^/(?:getfile|getpic)\.asp(?:$|\?)" ignoreCase="true" negate="true" />
                </conditions>
                <action type="Rewrite" value="max-age=0, must-revalidate, no-cache, no-store, private" />
              </rule>
              
           
            </outboundRules>
   
        </rewrite>
        
        <httpProtocol>
            <customHeaders>
                <add name="X-Content-Type-Options" value="nosniff" />
            </customHeaders>
        </httpProtocol>
        
        <!-- (SS,8/11/25) added following to OTW because cache wasn't working for static files like images and .js, .css etc. 30 days -->        
        <staticContent>
            <clientCache cacheControlMode="UseMaxAge" cacheControlMaxAge="30.00:00:00" />
        </staticContent>        

    </system.webServer> 
 
</configuration>