Sometimes IIS redirects the value of a URL parameter URL

We have a multi-user application with a web server in the following environment:

  • Datacenter Windows 2008 R2
  • IIS 7.5
  • ASP.NET 4.5
  • All traffic running in HTTPS
  • Form Authentication

We have some convenience redirects in place in the website's Web.config file. For one of the redirects, the URL parameter value is processed randomly (<1%) in the request immediately after the 301 redirect .

This rule is for redirecting URLs such as https://www.myapp.com/some_client_id/notifications to https://www.myapp.com/lms/profile/notifications.aspx?cid=some_client_id

Here is his definition:

<rule name="Redirect profile notifications page" stopProcessing="true">
    <match url="^([^/]+)/notifications/?$" />
    <conditions>
        <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
        <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
    </conditions>
    <action type="Redirect" url="lms/profile/notifications.aspx?cid={R:1}" />
</rule>

Looking at the WWW magazines, I see something like:

2014-07-03 09:40:19 W3SVC2 a.b.c.d GET /some_client_id/notifications - 443 - w.x.y.z Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/5.0) - - www.myapp.com 301 0 0 581 297 156
2014-07-03 09:40:19 W3SVC2 a.b.c.d GET /lms/profile/notifications.aspx cid=mang_ledch_rs 443 - w.x.y.z Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/5.0) - - www.myapp.com 302 0 0 693 277 109
2014-07-03 09:40:19 W3SVC2 a.b.c.d GET /lms/login.aspx ReturnUrl=%2flms%2fprofile%2fnotifications.aspx%3fcid%3dmang_ledch_rs&cid=mang_ledch_rs 443 - w.x.y.z Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/5.0) - - www.myapp.com 200 0 0 7173 336 218

, :

  • ,
  • (, "j" "w", "l" "y" )

, . Fiddler, .

, ? , ? .

+1
1

, , ROT13 , , .

+1

Source: https://habr.com/ru/post/1606639/


All Articles