File: D:/web/hyperflight/! bs3/web.config
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<defaultDocument>
<files>
<add value="products.asp" />
</files>
</defaultDocument>
<httpErrors errorMode="DetailedLocalOnly">
<remove statusCode="404" subStatusCode="-1" />
<error statusCode="404" prefixLanguageFilePath="" path="/products.asp?page=404" responseMode="ExecuteURL" />
</httpErrors>
<rewrite>
<rules>
<rule name="Redirect non-www to www" stopProcessing="true">
<match url=".*" />
<conditions>
<add input="{HTTP_HOST}" pattern="^www\.(.*)$" negate="true" />
<add input="{HTTP_HOST}" pattern="^dev\.(.*)$" negate="true" />
<add input="{HTTP_HOST}" pattern="^dev-(.*)\.(.*)$" negate="true" />
<add input="{HTTP_HOST}" pattern="^secure\.(.*)$" negate="true" />
</conditions>
<action type="Redirect" url="https://www.{HTTP_HOST}/{R:0}" redirectType="Permanent" />
</rule>
<rule name="HTTP to HTTPS redirect" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="off" ignoreCase="true" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
</rule>
<rule name="Rewrite sitemap.xml to google-sitemap.asp" patternSyntax="ExactMatch" stopProcessing="true">
<match url="sitemap.xml" />
<action type="Rewrite" url="google-sitemap.asp" appendQueryString="false" />
</rule>
<rule name="Rewrite sitemap.htm to products.asp?page=sitemap" patternSyntax="ExactMatch" stopProcessing="true">
<match url="sitemap.htm" />
<action type="Rewrite" url="products.asp?page=sitemap" appendQueryString="false" />
</rule>
<rule name="Redirect RCMF slash s (1)" stopProcessing="true">
<match url="^s/(.*)$" ignoreCase="false" />
<action type="Redirect" redirectType="Permanent" url="http://www.hyperflight.co.uk/{R:1}" />
</rule>
<rule name="Redirect RCMF slash s (2)" patternSyntax="ExactMatch" stopProcessing="true">
<match url="s" ignoreCase="false" />
<action type="Redirect" redirectType="Permanent" url="http://www.hyperflight.co.uk" />
</rule>
<rule name="Rewrite for callback from Payzone" patternSyntax="ExactMatch" stopProcessing="true">
<match url="checkout/callback/payzone" />
<action type="Redirect" url="products.asp?cmd=checkout&stage=co&pt=PAYZONE" redirectType="Temporary" />
</rule>
</rules>
<outboundRules>
<!-- Remove Pragma for all ASP pages -->
<!-- (SS,09/11/25) for PCI compliance, i.e. the no-cache added by dbfunctions.asp DisableCache routine -->
<rule name="Remove Pragma for ASP" enabled="true">
<match serverVariable="RESPONSE_Pragma" pattern=".*" />
<conditions>
<add input="{URL}" pattern="\.asp(?:$|\?)" ignoreCase="true" />
</conditions>
<action type="Rewrite" value="" />
</rule>
<!-- COOKIE FLAGS FIRST (because of stopProcessing="true" for .asp rules) -->
<!-- (SS,8/11/25) check and add cookie flags, already had SameSite=None -->
<rule name="Add HttpOnly Cookie Flag" preCondition="No HttpOnly">
<match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" />
<action type="Rewrite" value="{R:0}; HttpOnly" />
<conditions>
</conditions>
</rule>
<rule name="Add Secure Cookie Flag" preCondition="No Secure">
<match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" />
<action type="Rewrite" value="{R:0}; Secure" />
<conditions>
</conditions>
</rule>
<rule name="Add SameSite Cookie Flag" preCondition="No SameSite">
<match serverVariable="RESPONSE_Set_Cookie" pattern=".*" />
<action type="Rewrite" value="{R:0}; SameSite=None" />
</rule>
<preConditions>
<preCondition name="No HttpOnly">
<add input="{RESPONSE_Set_Cookie}" pattern="." />
<add input="{RESPONSE_Set_Cookie}" ignoreCase="true" pattern=";\s*HttpOnly" negate="true" />
</preCondition>
<preCondition name="No Secure">
<add input="{RESPONSE_Set_Cookie}" pattern="." />
<add input="{RESPONSE_Set_Cookie}" ignoreCase="true" pattern=";\s*Secure" negate="true" />
</preCondition>
<preCondition name="No SameSite">
<add input="{RESPONSE_Set_Cookie}" pattern="." />
<add input="{RESPONSE_Set_Cookie}" ignoreCase="true" pattern=";\s*SameSite" negate="true" />
</preCondition>
</preConditions>
<!-- (SS,8/11/25) PCI no-cache for all .asp except getfile/getpic -->
<!-- getfile.asp WITH cache=y -> allow 7-day browser cache -->
<rule name="getfile cache=y (7d)" enabled="true" stopProcessing="true">
<match serverVariable="RESPONSE_Cache_Control" pattern=".*" />
<conditions logicalGrouping="MatchAll">
<add input="{URL}" pattern="^/getfile\.asp$" ignoreCase="true" />
<add input="{QUERY_STRING}" pattern="(^|&)cache=y(&|$)" ignoreCase="true" />
</conditions>
<action type="Rewrite" value="private, max-age=604800" />
</rule>
<!-- getfile.asp WITHOUT cache=y -> treat as sensitive -->
<rule name="getfile default (no-store)" enabled="true" stopProcessing="true">
<match serverVariable="RESPONSE_Cache_Control" pattern=".*" />
<conditions logicalGrouping="MatchAll">
<add input="{URL}" pattern="^/getfile\.asp$" ignoreCase="true" />
<add input="{QUERY_STRING}" pattern="(^|&)cache=y(&|$)" ignoreCase="true" negate="true" />
</conditions>
<action type="Rewrite" value="max-age=0, must-revalidate, no-cache, no-store, private" />
</rule>
<!-- getpic.asp = public image -> 7 day browser cache -->
<rule name="Cache 7d for getpic.asp" enabled="true" stopProcessing="true">
<match serverVariable="RESPONSE_Cache_Control" pattern=".*" />
<conditions>
<add input="{URL}" pattern="^/getpic\.asp$" ignoreCase="true" />
</conditions>
<action type="Rewrite" value="private, max-age=604800" />
</rule>
<!-- (SS,8/11/25) no cache for all other .asp files, also added max-age=0, must-revalidate, no-store, private for PCI compliance -->
<rule name="PCI no-cache other ASP" enabled="true" stopProcessing="true">
<match serverVariable="RESPONSE_Cache_Control" pattern=".*" />
<conditions logicalGrouping="MatchAll">
<add input="{URL}" pattern="\.asp(?:$|\?)" ignoreCase="true" />
<add input="{URL}" pattern="^/(?:getfile|getpic)\.asp(?:$|\?)" ignoreCase="true" negate="true" />
</conditions>
<action type="Rewrite" value="max-age=0, must-revalidate, no-cache, no-store, private" />
</rule>
</outboundRules>
</rewrite>
<httpProtocol>
<customHeaders>
<add name="X-Content-Type-Options" value="nosniff" />
</customHeaders>
</httpProtocol>
<!-- (SS,8/11/25) added following to OTW because cache wasn't working for static files like images and .js, .css etc. 30 days -->
<staticContent>
<clientCache cacheControlMode="UseMaxAge" cacheControlMaxAge="30.00:00:00" />
</staticContent>
</system.webServer>
</configuration>