I have moved an old web app from being hosted on a very old custom implementation of a web host using Cassini to .net core 2.2 hosted in IIS.
Since the old servers were a self implementation, it wasn't rejecting some requests that IIS is rejecting.
To be specific, the problem is with POST requests with no body and no Content-Length header, with a Transfer-Encoding header of "chunked". There is absolutely no reason not to use simple GET requests there, but this is the situation.
The requests are sent from an old plugin that some of the clients are using, and we can't make them upgrade it to a newer version that is sending valid GET requests. Currently IIS is rejecting the requests with a 502 code. Therefor, we need to maintain an old version of the server just for these clients.
I am looking for a way to configure IIS to forward these requests to the .net core web app despite being invalid and to handle them there (when tested on Kestrel without IIS, the results are returned as expected).
Thanks
The problem was with IIS that acted as a reverse proxy since I used out of process hosting. Once I switched to in process hosting the request went directly to the server and the problem was solved.
https://weblog.west-wind.com/posts/2019/Mar/16/ASPNET-Core-Hosting-on-IIS-with-ASPNET-Core-22
I have a RESTApi application which I have recently moved over to Microsoft Azure App-services. Earlier it was hosted on a Linux server. The issue that I am seeing is weird:
When a client using ASP.net call a POST request with no body and no content-length header explicitly passed, the request fails with 411 Content-length required error. For the same client, the requests which were going on to the Linux server are still working fine.
For a client using python/PHP, the same request works on both the IIS and Linux environments.
I am unable to understand why this might be happening. I have resolved the issue by sending content-length:0 for this API call but want to understand why this is happening.
My errors are becoming more and more ridiculous every minute. I now have the ultimate problem with my reverse proxy.
An IIS8 reverse proxy should send all requests coming for
(.*)\.nsf(.*)
(.*)\.ibmxspres(.*)
to the IBM Domino http server - which it does, at least for basic requests that every third-grader deems valid.
But now, guess what happens when I open the following "URL" (a) on the IBM Domino HTTP directly and (b) via IIS8 Reverse proxy:
http://www.mydomain.com/xsp/.ibmxspres/.mini/css/2Ojcore.css&2Ojdojo.css&2OldefaultTheme.css&2OldojoTheme.css&#Da&#Ib&#Th&#Ti&2TgxspSF.css&Wdojoroot/dojo/resources/dojo.css&Wdojoroot/dojox/grid/enhanced/resources/claro/EnhancedGrid.css&Wdojoroot/dojox/grid/enhanced/resources/tundra/EnhancedGrid.css&Wdojoroot/dojox/grid/enhanced/resources/EnhancedGrid_rtl.css&Wdojoroot/dojox/grid/resources/tundraGrid.css&Wdojoroot/dojox/grid/resources/claroGrid.css&Wdojoroot/dojox/grid/resources/Grid.css.css
Is this an URL that every HTTP server should be able to handle?
If yes, why isn't IIS routing them through, although they match the rule?
If no, why is IBM using such non-standard HTTP requests, and can I change this behaviour somewhere?
I have installed the isapi_redirect into IIS, and allowed to run.
I have enabled the ajp13 in Jetty and I can telnet to port 8009.
This is my current uiworkermap.properties:
/hudson=jetty
/hudson/*=jetty
If I make a request to "http://localhost/hudson" or any subdirectory I get a 404 error.
All the other urls return the site defined in IIS.
This tells me that the isapi_redirect is looking at the uiworkermap file and trying to redirect correctly.
In the Jetty log and in the isapi_redirect log I don't see any errors.
If I go to http://localhost:8008/hudson I see it correctly.
Do you have any idea what could cause this?
UPDATE: I created a virtual directory with name "Jakarta" that pointed to the isapi_redirect dll like it is said here: http://tomcat.apache.org/connectors-doc/webserver_howto/iis.html
After this step the error changed, now in the browser I see:
Bad Gateway!
There is a problem with the page you are looking for, and it cannot be displayed. When the Web server (while acting as a gateway or proxy) contacted the upstream content server, it received an invalid response from the content server.
Jakarta/ISAPI/isapi_redirector/1.2.32 ()
In the error log (in debug mode) I can see that it first connects and the request is made but there is no response from jetty, and this error is generated:
[error] ajp_get_reply::jk_ajp_common.c (2118): (jetty) Tomcat is down or refused connection. No response has been sent to the client (yet)
This is the part of the log with the request and error:
https://rapidshare.com/files/3999719393/isapi_redirect_log.txt
Ok, in the end not having any help from stackoverflow users and also reading that in the official Jetty site about ajp13:
It is recommended to NOT use the AJP protocol, and superior
performance and clearer semantics will be achieve using HTTP.
I gave up on ajp and used a great and well documented open source dll to have HTTP proxy functions in IIS, IIRF.
So I would suggest anyone who has similar issues to just use an HTTP proxy instead.
Sorry if it is a duplicate, as I am not a security nor network expert I may have missed the correct lingo to find information.
I am working on an application to intercept and modify HTTP requests and responses between a web browser and a web server (see how to intercept and modify HTTP responses on server side? for the background). I decided to implement a reverse proxy in ASP.Net which forwards client requests to the back-end HTTP server, translates links and headers from the response to the properly "proxified" URL, and sends the response to the client after having extracted relevant information from the response.
It is working as expected, except for the authentication part: the web server uses NTLM authentication by default, and just forwarding requests and responses through the reverse proxy does not allow the user to be authenticated on the remote application. Both the reverse proxy and the web application are on the same physical machine and are executed in the same IIS server (Windows server 2008/IIS 7 if that matters). I tried both enabling and disabling authentication on the reverse proxy app with no luck.
I have looked for information about it, and it seems to be related to the "double-hop problem", which I do not understand. My question is: is there a way to authenticate the user on the remote application through the reverse proxy using NTLM? If there is none, are there alternative authentication methods I could use?
Even if you don't have a solution to my problem, just pointing me to relevant information about it to help me get out of the confusion would be great!
I found what the problem was (and it is NTLM): in order to have the browser asks the user for its credentials, the response must have a 401 status code. My reverse proxy was forwarding the response to the browser, so IIS was adding a standard HTML code to explain the requested page cannot be accessed thus preventing the browser from asking credentials.
The problem was solved by removing the response content when the status code is a 401.
With all due respect I have for the one that answered that some years ago, I must admit this is plainly false. The problem was indeed solved AFTER removing the response content when the status code is a 401, but it had none to do with the initial problem..
The truth is that windows authentication was made to authenticate people over local windows networks, where no proxy server is present or even needed.
The main problem with NTLM authentication is that this protocol does not authenticate the HTTP session but the underlying TCP connection, and as far as I know there is no way to access it from asp code.
Every proxy server I tried broke NTLM authentication.
Windows authentication is comfortable for an user because he won't ever need to enter your password to whatever application may lie in your intranet, frightening for a security guy because there is an auto-login without even a prompt if the site domain is trusted by IE, shocking for a network administrator because it melts the application, transport and network layer into some "windows ball of mug" instead of just plain http traffic.
NTLM won't work if the TCP packets are not forwarded exactly as the reverse proxy received > them. And that's why many reverse proxy doesn't work with NTLM authentication. (like nginx) > They forward HTTP requests correcty but not the TCP packets.
Nginx has the functionality to work with NTLM authentication. Keepalive needs to be enabled which is only available trough the http_upstream_module. Additionally in the location block you need to specify that you will be using HTTP/1.1 and that the "Connection" header field should be cleared for each proxied request. Nginx config should look something like:
upstream http_backend {
server 1.1.1.1:80;
keepalive 16;
}
server {
...
location / {
proxy_pass http://http_backend/;
proxy_http_version 1.1;
proxy_set_header Connection "";
...
}
}
I scratched my head for quite some time with this issue but the above works for me. Note that if you need to proxy HTTPS traffic, a separate upstream block is deemed necessary. To clarify a bit more, "keepalive 16;" specifies the number of simultaneous connections to the upstream your proxy is allowed to keep. Adjust the number as per the expected number of simultaneous visitors on the site.
Although this is an old post, I just want to report that it works for me quite well with an Apache2.2 reverse proxy and the keepalive=on option. Obviously, this keeps the connection between the proxy and the SharePoint host open and "pinned" to the client<>proxy connection. I don't exactly know the mechanisms behind this, but it works fairly well.
But: Sometimes, my users encounter the issue that they're logged in as another user. So there seems to be some mixing-up through sessions. I will have to give this some further testing.
Solution for everything (in case you have a valid, signed SSL certificate): Switch IIS to Basic Auth. This works absolutely fine, and even Windows (i.e. Office with SharePoint connection, all WebClient-based processes etc.) won't complain at all.
But they will when you're just using http without SSL/TLS, and also with self-signed certificates.
I confirm that it works with "keep-alive=on" on apache2.2
I examined frames with Wireshark, and I know why it doesn't work. NTLM won't work if the TCP packets are not forwarded exactly as the reverse proxy received them. That's why many reverse proxies, like nginx, don't work with NTLM authentication. Reverse proxies forward HTTP requests correctly but not the TCP packets.
NTLM requires a TCP reverse proxy.