Handle Authorization Header in IIS - iis

I would migrate from Azure Web App Linux (PHP application , apache server ) to Azure Windows App Service (IIS) and i 'am confused about handling authorization header in IIS
In .htaccess , i simply putting these lignes , and the Application work fine.
# Handle Authorization Header
# RewriteCond %{HTTP:Authorization} .
# RewriteRule .* - [E=Authorization:%{HTTP:Authorization}]
I try to import these rules in hosted IIS server, but it's look IIS unable to convert them.
So can someone can help me?
Regards.

When use linux webapp, you need .htaccess file. But in windows, you need add web.config, becase your webapp host on IIS.
In linux, you use below code.
# Handle Authorization Header
# RewriteCond %{HTTP:Authorization} .
# RewriteRule .* - [E=Authorization:%{HTTP:Authorization}]
In Windows.
I think below is you want.
<httpProtocol>
<customHeaders>
<add name="Access-Control-Allow-Origin" value="*" />
<add name="Access-Control-Allow-Methods" value="*" />
<add name="Access-Control-Allow-Headers" value="Content-Type, Authorization" />
</customHeaders>
</httpProtocol>

Related

IIS 7 set default page for the whole site

I have followed the instruction reported here :
https://www.c-sharpcorner.com/UploadFile/francissvk/set-default-page-for-a-website-in-iis421/
What i would like to achieve, is that when user try to visit my site : "https://mysitename.com" it should be redirected to the home page ( "https://mysitename.com/pages/home.aspx").
I don't want to create a root Default.aspx page only to do the redirect, i would like to achieve this behaviour through Web.config.
As said, i tried the instruction in the above link, buy also tried the many solution proposed on this site that more or less suggest to add this configuration to Web.config :
<system.webServer>
<defaultDocument enabled="true">
<files>
<clear />
<add value="/Pages/Home.aspx"/>
</files>
</defaultDocument>
<handlers>
I have tried different variation of the path, i have tried :
<add value="/Pages/Home.aspx"/>
<add value="~/Pages/Home.aspx"/>
<add value="./Pages/Home.aspx"/>
<add value="Home.aspx"/>
But allways i get this message error :
403 - Access denied.
If i manually enter in the browser the full page url "https://mysitename.com/pages/home.aspx" then i get no issue (just to point out that the page exists and is working)
I don't understand what i am missing in the configuration
A default page or DefaultDocument in IIS can't do what you want.
It is a feature that defines which document is loaded when a user requested a URL pointing to a directory on the server without specifying an actual page.
The value field should be the name of a file in that directory such as index.html or home.asp, it can not point to files in other directories.
In your case you may be able to use the builtin HTTP Redirect feature, in the GUI enable it and point to 'pages', also check the Only redirect requests to... checkbox
In your root web.config this may look like this:
<system.webServer>
<httpRedirect enabled="true" destination="pages" childOnly="true" />
<defaultDocument enabled="true">
<files>
<clear />
<add value="Home.aspx"/>
</files>
</defaultDocument>
</system.webServer>
Another option is to use the IIS Rewrite Module which allows you to create more complex rules on how to redirect and rewrite requests. It should be faster because it does work without a HTTP redirect which does back to the browser, but you first need it install it and understand how to use it.

How to force IIS to use a specific value for the http host header during a rewrite

I'm trying to create a rewrite rule that configures a web site to be used as a reverse proxy, but I'm having some issues setting the host http header to a predefined value different from the domain used in the rewrite (the objective is to use IIS as a reverse proxy for forwarding urls to sendgrid with a custom host value).
In order to illustrate the problem, I've created 2 web sites named url and sendgrid with the bindings url.com and sendgrid.net (I've added custom entries for these names on the hosts file so that the names can be resolved). Now, I need to redirect all requests received on the url web site to the sendgrid website, making sure that the request to the sendgrid web site sets the host http header to url.com. I've started by adding a rewrite rule to the url web site that looks like this:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="ReverseProxyInboundRule1" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{CACHE_URL}" pattern="^(https?)://" />
</conditions>
<action type="Rewrite" url="http://sendgrid.net/{R:1}" logRewrittenUrl="true" />
<serverVariables>
<set name="HTTP_HOST" value="url.madeira.gov.pt" />
</serverVariables>
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>
The applicationhost.config file has also been updated so that the HTTP_HOST can be changed:
<location path="url">
<system.webServer>
<rewrite>
<allowedServerVariables>
<add name="HTTP_HOST" />
</allowedServerVariables>
</rewrite>
</system.webServer>
</location>
In order to see what's going on, I've activated Failed Request Tracing and I've noticed that the host header file defined through the previous rule is not applied. I can see that the rule is processed and that the HTTP_HOST header is processed (SET_SERVER_VARIABLE), but when the request is rewritten, it will always set the http host to sendgrid.net (instead of setting it to url.com):
So, is there a way to force the use of a specific value to the host header when a IIS web site is configured to be used as a reverse proxy?
try to set the preserveHostHeader to true by following the below steps:
1)open IIS manager, select the server node.
2)double clic configuration manager.
3)from the section drop down select system.webServer/proxy
4)set preserveHostHeader to true
Note: if you are trying to change the request header it is not possible by using iis URL rewrite rule.

Microsoft Azure cannot start debugging because of the rewrite rule

I'm trying to add an http to https redirection rule into my azure web roles web.config file but when I add it, It gives me the error which you can see in the image. I found out that the rule line is responsible for this error.
What can I do?
Servicedefinition.cscfg:
Does you cloud service definition have HTTPS setup locally. The error suggests you haven't. I would therefore use web.config transforms so that my locally running instance does not have the redirect and cloud deployments do or make https valid on your local debugging so that the debugger is connecting to the HTTPS. I assume you have both an http and https endpoint in your definition.
Finally i've found the reason. It wasn't anything about azure. This rule also rewrites the path of the debugattach.aspx, this is the reason why visual studio cannot start debugging. To fix this issue I added this rule:
<rule name="debug" enabled="true" stopProcessing="true">
<match url="^debugattach\.aspx" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
<action type="None" />
</rule>

Windows Server 301 redirect

I have a .net site on a shared host environment so I don't have access to other solutions that require access to the server.
If I put the following code in my current web.config, is it enough to do the 301 redirect to my-new-site.com? Thanks.
<system.webServer>
<httpRedirect enabled="true" destination="http://www.my-new-site.com/" />
</system.webServer>
HTTP Redirection is not available on the default installation of IIS 7. You have to add it in Common Http Features for the Web Server Role. Is it enabled on your shared host ?
The correct way to do a permanent 301 redirect is :
<system.webServer>
<httpRedirect enabled="true" destination="http://www.my-new-site.com/" httpResponseStatus="Permanent" />
</system.webServer>
the default is response status is 302 (Found). More infos here.

Rewrite rules for response headers in IIS 7 (replacing the cookie path)

I have to port my web application from apache to IIS 7 and got into trouble with the proper configuration.
In the apache configuration, I configured some mod rewrite stuff (in order to communicate with an apache active mq) like this:
#Reverse-Proxy to ActiveMQ AJAX-Interface
ProxyPass /foo/bar/amq http://localhost:8161/foo/amq/
ProxyPassReverse /foo/bar/amq http://localhost:8161/foo/amq/
ProxyPassReverseCookiePath /foo /
I've tried to configure the IIS 7 by using ApplicationRequestRouting.
The rewrite rule in the request for replacing the /foo/bar to the localhost adress does already work, but I've some problems to define a rule for setting up the correct cookie path in the response.
I've already found an article about manipulating responses here.
For me, it looks like with II7 I can only manipulate the HTTP body of the response.
How can I manipulate the response header in a way to edit the cookie path?
The cookie path in the response header looks like this:
Set-Cookie: JSESSIONID=1lu7hn253csbh11jax27k2i072;Path=/foo
The Path should be edited to "Path=/".
Thank for your time and your help
Rolf
This should do it
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<outboundRules>
<remove name="Update Cookie Path" />
<rule name="Update Cookie Path">
<match serverVariable="RESPONSE_Set_Cookie" pattern="^(.*; path=/)foo$" />
<conditions />
<action type="Rewrite" value="{R:1}" />
</rule>
</outboundRules>
</rewrite>
</system.webServer>
</configuration>
Check the more detailed reference.

Resources