2

I use IIS and URL rewrite as a reverseProxy. My actual webapplication is hosted on a server which is not directly accessible to the internet.

In the rewrite rules I replace the host name of the reverse Proxy with the local IP address. This works fine.

However, the application I use provides downloads. Once the client makes a download request a server side process redirects to the actual download file.

This is where I have issues. It seems like the session cookie (JSESSIONID) is not correctly shared between reverse proxy and local server. Instead of being redirected to the download file, I get a 401 "not authorized" message from the local server.

I found a similar question here. How to properly set JSESSIONID cookie path behind reverse proxy The user was using Apache as a reverse proxy and was using ProxyPassReverseCookieDomain to rewrite the cookie domain name.

Is there a similar setting in IIS? I tried the following outbounding rule but this doesn't work.

<preCondition name="contains-domain-set-cookie-header">
  <add input="{RESPONSE_Set_Cookie}" pattern=".*?domain=MYDOMAIN*?" />
</preCondition>
<rule name="rewrite cookie domain" preCondition="contains-domain-cookie-header">
  <match serverVariable="RESPONSE_Set_Cookie" pattern="^(.*?domain=)MYDOMAIN(.*?)$" negate="false" />
  <action type="Rewrite" value="{R:1}MYLOCALIP{R:2}" /> 
</rule>

Are there other ways to handle this?

Thanks,

Thomas

1

1 Answer 1

3

Found the answer here and here

To preserve the Host Header run this from command line to update Machine/webroot/apphost config

%windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/proxy -preserveHostHeader:true /commit:apphost
1
  • This worked perfectly for me, I was literally fighting with IIS for a week trying to get this to work, thanks! :) Jun 28, 2022 at 19:05

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.