Posted: 14 November 2007 at 4:43am | IP Logged

Proxiing script which authenticates by looking for an asp session variable "Login". Also useful because it keeps the asp session alive while proxiing in case the application returns to an asp page.

The Script calls a second asp script "check-session.asp" that has enabelsessionstate set to true
-------- checksession.asp ------------------
<%@ Language=JScript EnableSessionState=True%>
<% if (Session("Login")) Response.Write ("1"); else Response.write ("0") %>
----------------------------------------

The proxiing script "rails-proxy.asp"
--------- rails-proxy.asp ----------------
<%@ Language=JScript EnableSessionState=False%>
<%
var HttpReq = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
HttpReq.Option( 6) = false //WinHttpRequestOption_EnableRedirects
var cookie =Request.ServerVariables( "HTTP_COOKIE")

HttpReq.open( "GET", "http://"+ Request.ServerVariables("HTTP_HOST") +"/stats/check-session.asp", true);
HttpReq.setRequestHeader( "Cookie", cookie); HttpReq.send

if(!HttpReq.WaitForResponse(5)){ HttpReq.Abort();
 Response.Redirect( Request.ServerVariables("HTTP_X_REWRITE_URL")) }
if( HttpReq.responseText !="1") Response.redirect( "/stats/userLogin.asp?logout=2")

HttpReq.open( Request.ServerVariables("REQUEST_METHOD"), "http://192.168.4.218:3000/rails/" + Request.QueryString, false);
HttpReq.setRequestHeader( "Cookie", cookie);
if( String( Request.ServerVariables( "CONTENT_TYPE"))) HttpReq.setRequestHeader( "Content-Type", Request.ServerVariables( "CONTENT_TYPE"))
HttpReq.setRequestHeader( "User-Agent", Request.ServerVariables( "HTTP_USER_AGENT"));
if( Request.ServerVariables( "HTTPS") =="on") HttpReq.setRequestHeader( "X-Forwarded-Proto", "https");
HttpReq.setRequestHeader( "X-Forwarded-Host", Request.ServerVariables( "HTTP_HOST"));

if( Request.TotalBytes) HttpReq.send( Request.BinaryRead( Request.TotalBytes)); else HttpReq.send;

Response.Status = "" + HttpReq.status + " " + HttpReq.statusText;

var contentType = HttpReq.getResponseHeader("Content-Type")
if (contentType) Response.ContentType = contentType

headers=String( HttpReq.getAllResponseHeaders()).split("\n");
for( var i=0; i<headers.length && headers; i++) {
 var header = headers.match(/([\w-\.]+):\s*([ \S]*)/);
 if( header &&( header[1] !="Content-Type")) Response.AddHeader( header[1], header[2]);
}

Posted: 23 November 2007 at 4:46am | IP Logged

Updated script also handles "304 not modified" responses.

-------------------------------------------------------------
<%@ Language=JScript EnableSessionState=False %>
<%
var HttpReq = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
HttpReq.Option( 6) = false //WinHttpRequestOption_EnableRedirects

HttpReq.open( "GET", "http://"+ Request.ServerVariables("HTTP_HOST") +"/stats/check-session.asp", true);
HttpReq.setRequestHeader( "Cookie", Request.ServerVariables( "HTTP_COOKIE")); HttpReq.send

if(!HttpReq.WaitForResponse(1)){ HttpReq.Abort(); %>
 <form name=retry method="<%= Request.ServerVariables("REQUEST_METHOD") %>"
   action="<%= Request.ServerVariables("HTTP_X_REWRITE_URL") %>">
  <% for( var f =new Enumerator( Request.Form()); !f.atEnd(); f.moveNext()){
   var key = f.item(); %>
   <input type=hidden name="<%= key %>" value="<%= Request.Form( key) %>">
  <% } %>
 </form>
 <script>window.onload=function(){retry.submit()}</script>
 <% Response.end }
if( HttpReq.responseText !="1") Response.redirect( "/stats/userLogin.asp?logout=2")

HttpReq.open( Request.ServerVariables("REQUEST_METHOD"), "http://192.168.4.218:3000/rails/" + Request.QueryString, false);

//fs=new ActiveXObject("Scripting.FileSystemObject")
//Application("fno") =Application("fno") +1
//of=fs.OpenTextFile("C:\\Websites\\syntec\\stats\\proxy." +Application("fno") +".log", 8, true, 0)

var rheaders= String( Request.ServerVariables("ALL_RAW")).split("\n");
for(var i=0; i<rheaders.length && rheaders; i++){
 var rheader = rheaders.match(/([\w-\.]+):\s*([ \S]*)/);
// of.write( rheader[1] +"=" +rheader[2] +"\n")
 if(( rheader[1] !="Host")) HttpReq.setRequestHeader( rheader[1], rheader[2])
}

Posted: 06 January 2008 at 12:29am | IP Logged

Latest version of this script is below.

Notes:
1.   The commented lines are for debug purposes
2.   Enablesessionstate must be false otherwise the script just hangs (I don't know why). If it could be true then the authentication part could be done in the body of the script instead of calling a separate asp page.
3.   Auto-redirect by the winhttp proxy must be disabled for most web applications to work effectively. If we did not need to do this we could use ServerXMLhttp which is more scaleable then winhttprequest.
4.   When the IIS server is restarted or the proxy script is edited, the first call to check-session.asp hangs - hence the redirect/retry code which fixes this problem with effectively a browser refresh.
5.   check-session.asp contains the authentication code which checks the requested url and session vars and returns -1 for session timeout, 1 if authenticated and 0 (or anything else) if not.

----------------------------------
<%@ Language=JScript EnableSessionState=False %>
<%
//Application( "fno") =Application( "fno") +1
//var fs =new ActiveXObject( "Scripting.FileSystemObject")
//var of =fs.OpenTextFile( "C:\\Websites\\syntec\\stats\\proxy." +Application("fno") +".log", 8, true, 0)

var HttpReq =new ActiveXObject( "WinHttp.WinHttpRequest.5.1");
HttpReq.Option( 6) =false //WinHttpRequestOption_EnableRedirects

HttpReq.open( "GET", "http://"+ Request.ServerVariables( "HTTP_HOST") +"/stats/check-session.asp?" +Request.QueryString, true);
HttpReq.setRequestHeader( "Cookie", Request.ServerVariables( "HTTP_COOKIE")); HttpReq.send

if( !HttpReq.WaitForResponse( 1)){ HttpReq.Abort();
// of.write( Request.QueryString +" - " +Request.ServerVariables( "REQUEST_METHOD") +" Retrying\n")
// of.write( "\nHTTP_X_REWRITE_URL=" +Request.ServerVariables( "HTTP_X_REWRITE_URL"))
 if( Request.ServerVariables( "REQUEST_METHOD") =="GET") Response.redirect( Request.ServerVariables( "HTTP_X_REWRITE_URL")) %>
 <form name=retry method="<%= Request.ServerVariables( "REQUEST_METHOD") %>"
   action="<%= Request.ServerVariables( "HTTP_X_REWRITE_URL") %>">
  <% for( var f =new Enumerator( Request.Form); !f.atEnd(); f.moveNext()){
   var key = f.item(); %>
   <input type=hidden name="<%= key %>" value="<%= Request.Form( key) %>">
  <% } %>
 </form>
 <script>window.onload=function(){retry.submit()}</script>
 <% Response.end }
if( HttpReq.responseText =="-1") Response.redirect( "/stats/userLogin.asp?logout=2")
if( HttpReq.responseText !="1"){ %>
 <p style=color:red;margin:50>Permission Denied
 <% Response.End }

HttpReq.open( Request.ServerVariables( "REQUEST_METHOD"), "http://" +Request.QueryString, false);

var rheaders= String( Request.ServerVariables( "ALL_RAW")).split("\n");
for(var i=0; i<rheaders.length && rheaders; i++){
 var rheader = rheaders.match(/([\w-\.]+):\s*([ \S]*)/);
// of.write( rheader[1] +"=" +rheader[2] +"\n")
 if(( rheader[1] !="Host")) HttpReq.setRequestHeader( rheader[1], rheader[2])
}

Posted: 15 February 2008 at 3:24pm | IP Logged

I forgot to mention. Need rewrie rule, eg.

RewriteRule /rails(/.*) /stats/reverse-proxy.asp\?192.168.4.218:3000$1 [L]

RewriteRule (/(?:search\?|smb/).*) /stats/reverse-proxy.asp\?129.178.88.72$1 [L]

to reverse-proxy a child domain (to some internal server) with the script.

Posted: 10 January 2011 at 4:08am | IP Logged

Has some slight tweaks for when running behind nginx
(as second reverse proxy)

It's probably the last version (posted below) as now
use X-Accel-Redirect when running behind nginx
(instead of double reverse-proxiing)

---------------------------------------------------------------------------
<%@ Language=JScript %><%
//var lno= Application( "lno")= Application( "lno")+1
//function log( msg){
//    function pad( n){ return '00000'.slice( n.toString().length) +n }
// Application( "log").write( pad( lno) +': '+ msg +'\n') }

var rheaders= Request.serverVariables( "all_raw").item.split("\n"), qs= Request.queryString.item;
if( !qs.match( /\?/)) qs= qs.replace( '&', '?')
//for( var i=0; i<rheaders.length && rheaders[i]; i++){
// var rheader= rheaders[i].match(/([\w-\.]+):\s*([ \S]*)/)
// log( rheader[1] +"=" +rheader[2]) }

function check_session(){
 //allow access to google appliance public collection
 if( qs.match( /\/search\?.*\bsite=public\b/)) return 1
 if( qs.match( /\/(?:nav_(?:current|first|last|next|page|previous)\.gif|user_help\.html|images\/logo_sm\.gif)/)) return 1

 //allow access to radupload
 if( qs.match( /^192.168.4.218:3000\/dndplus.jar$/)) return 1

 //force timeout login if not logged in to stats
 if( !Session( "userId")) return -1

 //allow all access to Syntec users
 if( Session( "syntecUser") ==1) return 1

 //allow access to rails public area
 if( qs.match( /\/(javascripts|stylesheets)\/.*/)) return 1

 //allow access to network status
 if( qs.match( /\/network_status/)) return 1

 //allow access to CT shirts report for CT shirts users
 if( Session( "clientAccountId")=="2971148972" && qs.match( /\/reports\/CTshirts_sched.jsp\?/)) return 1

 //otherwise deny permision
 return 0 }

switch( check_session()){
 case -1: Response.redirect( "/stats/userLogin.asp?logout=2"); break

 case 0: %><p style=color:red;margin:50>Permission Denied
 <% Response.end }

var httpReq =Server.createObject( "winHttp.winHttpRequest.5.1")
httpReq.option( 6)= false //winHttpRequestOption_enableRedirects
httpReq.option( 17)= false //WinHttpRequestOption_EnableHttp1_1

httpReq.open( Request.serverVariables( "request_method"), "http://" +qs, false)

for( var i=0; i<rheaders.length && rheaders[i]; i++){
 var rheader= rheaders[i].match(/([\w-\.]+):\s*([ \S]*)/);
 httpReq.setRequestHeader( rheader[1], rheader[2]) }

if( Request.serverVariables( "https") =="on") httpReq.setRequestHeader( "x-forwarded-proto", "https")

httpReq.setTimeouts( 0, 0, 0, 0)
httpReq.send( Request.binaryRead( Request.totalBytes))

Response.status =httpReq.status +" " +httpReq.statusText
//log( qs +" - " +Request.serverVariables( "request_method") +" " +Response.status)

var headers= httpReq.getAllResponseHeaders().split("\n")
for( var i=0; i<headers.length && headers[i]; i++) {
 var header= headers[i].match( /([\w-\.]+):\s*([ \S]*)/)
// if( header) log( "" +header[1] +"=" +header[2])
 if( header) switch( header[1].toLowerCase()){
  case "cache-control": Response.cacheControl= header[2]; break
  case "content-type": Response.contentType= header[2]; break
  case "content-length": break; case "server": break;
  default: Response.addHeader( header[1], header[2]) }}

//log( httpReq.responseText)

if( httpReq.responseText.length>0) Response.binaryWrite( httpReq.responseBody)
httpReq.close; httpReq= undefined
Response.end %>