Wildfly Block URL Pattern - security

Is there any config for wildfly application server to block customized URL pattern, or how can I block Bypassing 403 endpoints request for security purpose.
for example: my URL is https://xxxxxxxx.com/service
how can i block the URL like: https://xxxxxxxx.com/service/static/..;/

Related

What is the conceptual difference between redirect and rewrite with respect to serving static file content?

My understanding is that -
Redirection - When browser makes a request to url1, and assuming redirection rule is configured on the web server which redirects to url2, then the server will respond with the url2, and then the browser will make a new request to the url1. The browser url bar will show the url2. Effectively 2 requests are made by the browser.
Rewrite - When browser makes a request to url1, and assuming rewrite rule is configured on the web server which rewrite the url to url2, then the server will rewrite the url1 to url2 and pass the re-written url to the website's route handler, and then server will send response to the client. The browser url bar will still show the url1. Effectively only 1 request is made by the browser.
What is the conceptual difference between redirect and rewrite for static file content access? For example - does it make any difference to the client (browser/user)?

How to setup a reverse proxy in IIS using host file?

I'm trying to setup a reverse proxy in IIS 10 using some fake urls.
In my host file I set up :
127.0.0.1 somedomain.com
Then I created a website in IIS 10 binding to this domain and a fake page :
When typing somedomain.com on chrome, the fake page shows properly. I assume the fake domain website works.
I have then another website with a reverse proy rewrite rule. I expect requests to the new website to be rewritten and show the first somedomain.com
When running my reverse proxy website I'm getting the error :
HTTP Error 400.605 - Bad Request
The request cannot be routed because it has reached the Max-Forwards limit. The server may be self-referencing itself in request routing topology.
Does anyone know what I'm doing wrong please ?
I tried changing the rule action type to "Redirect" and I can see that the redirection works correctly.

IIS URL Rewrite for a folder to another web server

I have an IIS webserver running a website. I've installed ARR3 to enable routing rules.
I'd like to redirect all the incoming request for the URL .mydomain/url2redirect/ to an Apache server installed on the same machine where is running SVN.
So in the inbound rule definition I've inserted the following:
Input: URL path after '/'
Pattern: *.mydomain/url2redirect/*
Action Type: Rewrite
Action URL: https://ip-address:8080/{R:2}
By testing the pattern, I get the desired result, and in the R:2 back reference I get the requested page I need to pass to SVN, but I get always a 404.
"url2redirect" doesn't exist but it should captured by the URL rewrite and forwarded to the Action URL.
I've added any outbound rule. Should I have to add something? what?
I've tried also to add a Reverse Proxy Rule, using the ARR template but, it's completely ignored, therefore I think that the routing is not working at all on IIS.
As far as I know, the url rewrite rule Pattern doesn't match the domain part.
That means mydomain will not include in the Pattern.
If you want to match the url2redirect, you should use below pattern.
url2redirect(.*)
Then I suggest you could modify your action url as below:
https://ip-address:8080{R:1}

Stop IIS decoding %2f in URL

There is an API endpoint in my application that accepts a string as a URL parameter that may contain a / encoded as %2f.
For example, GET http://localhost:5000/api/foo/some%2fstring
The controller action receives this parameter in its encoded state (some%2fstring), and is able to handle this as it sees fit.
However, once deployed to IIS, this breaks. IIS seems to decode the URL before passing it to Kestrel. The logs show something like this:
info: Microsoft.AspNetCore.Hosting.Internal.WebHost[1]
Request starting HTTP/1.1 GET http://example.com/api/foo/some/string application/json
Obviously, that pattern does not match the route, and the request 404s.
How can I prevent IIS from manipulating the URL before sending it to Kestrel?

IIS Redirect from HTTP to HTTPS including Application Name

I'm adding a URL redirect rule to redirect a user from HTTP to HTTPS in a way that it preserves the original query. For example...
http://localhost/myapp/test >>
https://localhost/myapp/test
http://localhost/myapp/test?id=test >>
https://localhost/myapp/test?id=test
However the application name isn't being included in the redirect so what I actually get is the following...
http://localhost/myapp/test >>
https://localhost/test
Inbound Rule
IIS structure
Sites
Default Web site
MyApp
I believe I'm missing a IIS variable in my redirect url https://{HTTP_HOST}/{R:1} which represents the application.
Is there a IIS variable that represents the application level(MyApp) I can add to the redirect URL, or another way of doing this?
I managed to get this working by adding the URL variable.
https://{HTTP_HOST}{URL}

Resources