Iis – Prevent ARR with UrlRewrite from re-writing Location header for a 302 redirect

arriisreverse-proxyrewrite

I'm trying to deploy a jetty servlet using ARR and urlrewrite to create a reverse proxy. If I enable "Reverse rewrite host in response headers" then everything seems to work fine. I access the servlet at www.example.com/servlet, the address stays the same in the browser but the servlet is accessed at localhost:8080.

The issue is that this servlet returns 302 redirects depending on get parameters. So for example if I go to www.example.com/servlet?input=cleaning then I will get a 302 redirect which might go to www.cleaningexample.com/howtoclean. The reverse rewrite host rule means that instead of seeing this url the client is returned www.example.com/howtoclean.

I can't set a static outbound rule as I don't know ahead of time which address the 302 redirect may return.

If I disable the reverse rewrite host then the url in the browser changes from www.example.com/servlet to localhost:8080/servlet.

I've tried replacing the host in an outbound rule but I can't find anywhere to get the original location header returned by the servlet to replace the rewritten Location host with.

Is there a way to get this working correctly?

Best Answer

Did you ever figure this out? I am having the exact same issue. I cannot get both situations to behave correctly. It's either I check the box, and 302 redirects get the response location header overwritten and never work, or I uncheck the box and the HOST header is localhost so the application doesn't fully work.

It's like that checkbox needs to be a little smarter, and say 'if not a 302, do this'. Or I have to add rules/before and after, but I don't think that's going to be possible. :-(

---- 20 minutes later, got really lucky and found the answer.

https://stackoverflow.com/a/14842856/8333628

%windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/proxy -preserveHostHeader:true /commit:apphost

That command, plus the reverse rewrite host in response headers UNCHECKED seems to work. External redirects work with that box unchecked, and with that command to preserve the host, the downstream app no longer sees localhost:8080 but the original host in the browser address bar. Both work!!!

It's comical that there's just no option in the UI for preserveHostHeader. They just never added the checkbox. :) If you go in the 'configuration editor' in the control panel, you can see it there in the xml schema. So it's a legit, setting they just missed it in the UI options. :(

Related Topic