Posted: 14 November 2007 at 4:43am | IP Logged

Proxiing script which authenticates by looking for an asp session variable "Login". Also useful because it keeps the asp session alive while proxiing in case the application returns to an asp page.

The Script calls a second asp script "check-session.asp" that has enabelsessionstate set to true
-------- checksession.asp ------------------
<%@ Language=JScript EnableSessionState=True%>
<% if (Session("Login")) Response.Write ("1"); else Response.write ("0") %>
----------------------------------------

The proxiing script "rails-proxy.asp"
--------- rails-proxy.asp ----------------
<%@ Language=JScript EnableSessionState=False%>
<%
var HttpReq = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
HttpReq.Option( 6) = false //WinHttpRequestOption_EnableRedirects
var cookie =Request.ServerVariables( "HTTP_COOKIE")

HttpReq.open( "GET", "http://"+ Request.ServerVariables("HTTP_HOST") +"/stats/check-session.asp", true);
HttpReq.setRequestHeader( "Cookie", cookie); HttpReq.send

if(!HttpReq.WaitForResponse(5)){ HttpReq.Abort();
 Response.Redirect( Request.ServerVariables("HTTP_X_REWRITE_URL")) }
if( HttpReq.responseText !="1") Response.redirect( "/stats/userLogin.asp?logout=2")

HttpReq.open( Request.ServerVariables("REQUEST_METHOD"), "http://192.168.4.218:3000/rails/" + Request.QueryString, false);
HttpReq.setRequestHeader( "Cookie", cookie);
if( String( Request.ServerVariables( "CONTENT_TYPE"))) HttpReq.setRequestHeader( "Content-Type", Request.ServerVariables( "CONTENT_TYPE"))
HttpReq.setRequestHeader( "User-Agent", Request.ServerVariables( "HTTP_USER_AGENT"));
if( Request.ServerVariables( "HTTPS") =="on") HttpReq.setRequestHeader( "X-Forwarded-Proto", "https");
HttpReq.setRequestHeader( "X-Forwarded-Host", Request.ServerVariables( "HTTP_HOST"));

if( Request.TotalBytes) HttpReq.send( Request.BinaryRead( Request.TotalBytes)); else HttpReq.send;

Response.Status = "" + HttpReq.status + " " + HttpReq.statusText;

var contentType = HttpReq.getResponseHeader("Content-Type")
if (contentType) Response.ContentType = contentType

headers=String( HttpReq.getAllResponseHeaders()).split("\n");
for( var i=0; i<headers.length && headers; i++) {
 var header = headers.match(/([\w-\.]+):\s*([ \S]*)/);
 if( header &&( header[1] !="Content-Type")) Response.AddHeader( header[1], header[2]);
}

Posted: 23 November 2007 at 4:46am | IP Logged

Updated script also handles "304 not modified" responses.

-------------------------------------------------------------
<%@ Language=JScript EnableSessionState=False %>
<%
var HttpReq = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
HttpReq.Option( 6) = false //WinHttpRequestOption_EnableRedirects

HttpReq.open( "GET", "http://"+ Request.ServerVariables("HTTP_HOST") +"/stats/check-session.asp", true);
HttpReq.setRequestHeader( "Cookie", Request.ServerVariables( "HTTP_COOKIE")); HttpReq.send

if(!HttpReq.WaitForResponse(1)){ HttpReq.Abort(); %>
 <form name=retry method="<%= Request.ServerVariables("REQUEST_METHOD") %>"
   action="<%= Request.ServerVariables("HTTP_X_REWRITE_URL") %>">
  <% for( var f =new Enumerator( Request.Form()); !f.atEnd(); f.moveNext()){
   var key = f.item(); %>
   <input type=hidden name="<%= key %>" value="<%= Request.Form( key) %>">
  <% } %>
 </form>
 <script>window.onload=function(){retry.submit()}</script>
 <% Response.end }
if( HttpReq.responseText !="1") Response.redirect( "/stats/userLogin.asp?logout=2")

HttpReq.open( Request.ServerVariables("REQUEST_METHOD"), "http://192.168.4.218:3000/rails/" + Request.QueryString, false);

//fs=new ActiveXObject("Scripting.FileSystemObject")
//Application("fno") =Application("fno") +1
//of=fs.OpenTextFile("C:\\Websites\\syntec\\stats\\proxy." +Application("fno") +".log", 8, true, 0)

var rheaders= String( Request.ServerVariables("ALL_RAW")).split("\n");
for(var i=0; i<rheaders.length && rheaders; i++){
 var rheader = rheaders.match(/([\w-\.]+):\s*([ \S]*)/);
// of.write( rheader[1] +"=" +rheader[2] +"\n")
 if(( rheader[1] !="Host")) HttpReq.setRequestHeader( rheader[1], rheader[2])
}

Posted: 06 January 2008 at 12:29am | IP Logged

Latest version of this script is below.

Notes:
1.   The commented lines are for debug purposes
2.   Enablesessionstate must be false otherwise the script just hangs (I don't know why). If it could be true then the authentication part could be done in the body of the script instead of calling a separate asp page.
3.   Auto-redirect by the winhttp proxy must be disabled for most web applications to work effectively. If we did not need to do this we could use ServerXMLhttp which is more scaleable then winhttprequest.
4.   When the IIS server is restarted or the proxy script is edited, the first call to check-session.asp hangs - hence the redirect/retry code which fixes this problem with effectively a browser refresh.
5.   check-session.asp contains the authentication code which checks the requested url and session vars and returns -1 for session timeout, 1 if authenticated and 0 (or anything else) if not.

----------------------------------
<%@ Language=JScript EnableSessionState=False %>
<%
//Application( "fno") =Application( "fno") +1
//var fs =new ActiveXObject( "Scripting.FileSystemObject")
//var of =fs.OpenTextFile( "C:\\Websites\\syntec\\stats\\proxy." +Application("fno") +".log", 8, true, 0)

var HttpReq =new ActiveXObject( "WinHttp.WinHttpRequest.5.1");
HttpReq.Option( 6) =false //WinHttpRequestOption_EnableRedirects

HttpReq.open( "GET", "http://"+ Request.ServerVariables( "HTTP_HOST") +"/stats/check-session.asp?" +Request.QueryString, true);
HttpReq.setRequestHeader( "Cookie", Request.ServerVariables( "HTTP_COOKIE")); HttpReq.send

if( !HttpReq.WaitForResponse( 1)){ HttpReq.Abort();
// of.write( Request.QueryString +" - " +Request.ServerVariables( "REQUEST_METHOD") +" Retrying\n")
// of.write( "\nHTTP_X_REWRITE_URL=" +Request.ServerVariables( "HTTP_X_REWRITE_URL"))
 if( Request.ServerVariables( "REQUEST_METHOD") =="GET") Response.redirect( Request.ServerVariables( "HTTP_X_REWRITE_URL")) %>
 <form name=retry method="<%= Request.ServerVariables( "REQUEST_METHOD") %>"
   action="<%= Request.ServerVariables( "HTTP_X_REWRITE_URL") %>">
  <% for( var f =new Enumerator( Request.Form); !f.atEnd(); f.moveNext()){
   var key = f.item(); %>
   <input type=hidden name="<%= key %>" value="<%= Request.Form( key) %>">
  <% } %>
 </form>
 <script>window.onload=function(){retry.submit()}</script>
 <% Response.end }
if( HttpReq.responseText =="-1") Response.redirect( "/stats/userLogin.asp?logout=2")
if( HttpReq.responseText !="1"){ %>
 <p style=color:red;margin:50>Permission Denied
 <% Response.End }

HttpReq.open( Request.ServerVariables( "REQUEST_METHOD"), "http://" +Request.QueryString, false);

var rheaders= String( Request.ServerVariables( "ALL_RAW")).split("\n");
for(var i=0; i<rheaders.length && rheaders; i++){
 var rheader = rheaders.match(/([\w-\.]+):\s*([ \S]*)/);
// of.write( rheader[1] +"=" +rheader[2] +"\n")
 if(( rheader[1] !="Host")) HttpReq.setRequestHeader( rheader[1], rheader[2])
}

Posted: 15 February 2008 at 3:24pm | IP Logged

I forgot to mention. Need rewrie rule, eg.

RewriteRule /rails(/.*) /stats/reverse-proxy.asp\?192.168.4.218:3000$1 [L]

RewriteRule (/(?:search\?|smb/).*) /stats/reverse-proxy.asp\?129.178.88.72$1 [L]

to reverse-proxy a child domain (to some internal server) with the script.