I have an API that I want to be accessible only by HTTPS. I know I can use URL-rewrite to force a redirect, but don't want to install additional modules. I was wondering whether only providing an HTTPS binding would be a secure solution (in a way that HTTP connection would not be allowed).
Is it possible to somehow trick the server into accepting HTTP request with this kind of setup?
It is not possible to "trick" the server, but there are a couple of caveats here.
First, it is still possible to set up another site in IIS with a binding that will accept HTTP requests, so you need to be aware of the configuration of any other sites hosted on this server.
Second, this configuration means that if people attempt to visit the site directly or otherwise over the HTTP protocol, they'll simply get an error. Depending on your use case, this may be fine, and it's certainly the least complex option. If you have people accessing the site via a browser however, it's probably not. If it isn't you can (as you already know) set up an HTTP binding and redirect. This has the added advantage of preventing other sites from binding HTTP to this IP/host name, reducing the likelihood that a second site will erroneously serve the site over HTTP.
No - if there is no http binding, IIS will not accept an HTTP request. On 443, it will attempt to negotiate a TLS/SSL (depending on configuration) connection, if it cannot, the connection will fail.
https://msdn.microsoft.com/en-us/library/ff720335.aspx
Relevant quote : " By enabling SSL in Microsoft® Internet Information Services (IIS) 7.5/7.0, the [webservers] communicate using authentication and encryption for all data transfers."
Allowing https to degrade to http would be a serious violation of the TLS standard.
As an aside, you will probably also want to consider which protocols you support - all SSL protocols and TLS 1.0 are considered insecure at this point (TLS 1.1 and 1.2 are still fine). https://support.microsoft.com/en-us/kb/187498#LetMeFixItMyselfAlways shows you how to limit down to TLS 1.1 and 1.2. However, note that older browsers may not support 1.1 and 1.2 (almost anything relevant now supports 1.0), so depending on your target audience, you may need to still support TLS 1.0 for awhile longer.
HTTPS only is a bad idea if your site hosts public info, especially if that info is dynamically generated by a CMS. It makes ISP Internet caching and reverse proxy (such as squid/varnish) not work and that can lead to overloaded servers and exorbitant bandwidth usage. If you have a limited number of users this isn't a big deal but it will cripple your servers during large traffic spikes and lead to downtime unless you have a -lot- of computing resources.
