Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to correctly set HTTP header with managed IIS module

I've written my own managed IIS HTTP-module in C#. It's purpose is to simply set X-Forwarded-For and X-Forwarded-Proto request headers on some condition (which can not be handled with routing rules). The module must be deployed to our load balancer (which is none other than IIS with installed ARR and configured server farms). For some reasons the headers are set but are not transmitted to the web servers behind the load balancer. I know it because I checked the Failed Request Tracing output logs. Failed Request Tracing logs

And here is a screenshot of all the IIS Modules installed on our load balancer:

Ordered module list

As you can see my managed module called "QA.XForwardedHeadersModule" is loaded before the ApplicationRequestRouting (ARR) native module. But the headers aren't transmitted anyway. I even traced my requests with Wireshark. There aren't any X-Forwarded headers at all.

Does it mean that managed modules are not fully compatible with native modules and native modules (like ARR) can not see request headers set with managed modules (like my custom written module)? Is there any possible workaround to this problem?

like image 373
Dobby007 Avatar asked Dec 26 '17 15:12

Dobby007


People also ask

How do I enable HTTP headers in IIS?

Add custom HTTP response header in IIS 7.0In the connections pane, expand the node for the server, and then expand Sites. Select the web site where you want to add the custom HTTP response header. In the web site pane, double-click HTTP Response Headers in the IIS section. In the actions pane, select Add.

What is HTTP response header in IIS?

Overview. The <customHeaders> element of the <httpProtocol> element specifies custom HTTP headers that Internet Information Services (IIS) 7 will return in HTTP responses from the Web server. HTTP headers are name and value pairs that are returned in responses from a Web server.


1 Answers

This is an old "unanswered" post so I figured I would add my two cents. Adding request headers might not work in general, depending on how the ARR module/handler will process the request. It may be too late as Tarun mentioned, but for another reason. ARR module may be grabbing the raw data being received, in which case it definitely will be too late. Or ARR handler may be looking at particular Server Variables containing the original headers which were set before your notification (e.g. I don't think ALL_RAW is updated if you add additional request headers.) In the likely case ARR module is grabbing raw buffers, you would need to get ahead of that and update the raw data, which, if possible, is a whole new level of complexity.

like image 163
Brian Clink Avatar answered Oct 16 '22 20:10

Brian Clink