I wrote load testing of my API with NTLM auth (here I additionally check if NTLM authorized user is presend in Database). During resquest:
var url = 'https://login:*****#localhost:xxxx/api/authorization/logon';
var payload = { };
var params = {
headers: {
'Content-Type': 'application/json'
},
};
let response = http.post(url, params, {auth: "ntlm"});
check(response, {
'status is 200': (r) => r.status === 200
});
}
i have an error:
error="Post "https://user:*****#localhost:xxx/api/authorization/logon": stream error: stream ID 3; HTTP_1_1_REQUIRED".
Why? Kestrel serve HTTP/1.1
This is an issue in the way Go standard library's HTTP client operates, that is described here in detail, in which for HTTPS endpoints, connection is forcibly upgraded to HTTP/2.0, which is not supported by the NTLM protocol.
I'm not sure, but maybe you can disable this connection upgrade in Kestrel.
you can set in your global system environment to enable HTTP1.1
Related
I host a very simple node socket IO application on my Window Server, below are the code sample.
// socket.io 3.1.2"
const port = 30080;
const httpServer = require("http").createServer();
const io = require("socket.io")(httpServer, {
cors: {
origin: '*',
methods: ["GET", "POST"],
allowedHeaders: ["Access-Control-Allow-Origin"],
credentials: false
}
});
io.on("connection", socket => {
console.log('On Connection');
io.emit("message", 'Welcome to Socket Io.');
});
And I wrote some code to try connect to my socket IO server in a HTML File and work well. below are the code sample.
// <script src="https://cdn.socket.io/3.1.3/socket.io.min.js"></script>
const socket = io("http://myserverip:30080", {
withCredentials: false,
extraHeaders: {
"Access-Control-Allow-Origin": "*"
}
});
socket.on("connect", () => {
console.log('connect');
});
socket.on("message", (message) => {
console.log(message);
});
But when I try to use those above code in my .NET Core web application, I get the error "ERR_SSL_PROTOCOL_ERROR". Even I publish my web application on the Window Server still getting the same error message.
I have tried http, https, ws and wss protocol. None of these work. How can I get this possibly working?
I do not see the following in your server side code:
httpServer.listen()
Do you have a reverse proxy between your client and the server?
I would expect no SSL related error based on you code.
I would also use socket.io version 4 just for future maintenance reasons.
Vue 2 app (with okta auth) running on iis dev server HTTPS,
Trying to call (axios) a webApi (.netcore) web service on same iis server http, call is https instead, does it get converted?
I literally hardcoded the axios setup to be HTTP, but when i look in network teb of chrome devtools,
const apiClient = axios.create({
baseURL: 'http://studentportal4api.jcdev.org',// see http!!!!
// Timeout: 10000,
headers: {
Accept: 'application/json',
'Content-Type': 'application/json',
},
})
and..
return apiClient
.get('/DoCdssLoginTests', {
params: {
sAdName: adName,
},
})
.then((response) => {
if (response.data.errorType == 'Error') {
dispatch('handleErrorMsg', response)
} else {
<snip>
}
})
the call it https anyway....
What is converting to https? can I turn it off for testing? (long term it's going to all be https, but I"m trying to get it all up and running for the first time)
Using express-session so need cookie id for authentication, but even with setting up CORS correctly (or what I thought to be) on front and back end I'm still getting issues. CORS is working without cookies enabled.
Backend config
const corsOptions = {
origin: "*",
methods: "GET,HEAD,PUT,PATCH,POST,DELETE",
preflightContinue: false,
optionsSuccessStatus: 204,
credentials: true,
};
Frontend config (using Relay)
const response = await fetch("http://localhost:4002/graphql", {
method: "POST",
credentials: "include", // Allow cookies to be sent
headers: {
Authorization: `*/*`,
"Content-Type": "application/json",
}
If I do not include credentials the response shows that CORS cookies are allowed:
However, as soon as I enable credentials in the client fetch config, the request is blocked. There is no response, I think Firefox is blocking the req before it is sent?
Thank you in advance for any help!
The issue was not setting the accepted CORS origins to "*", as said in the console (thanks Quentin).
I'm working with Meteor and trying to establish NTLM authentication. I'm using the HTTP package to go through the NTLM "handshake" with the remote server. However, I'm running into an issue that I think is caused by the connection not being kept alive. I can't make it all the way through the handshake, because the remote server expects me to reuse the same HTTP connection but I'm making a new one every time (I'm not sure how note to). Below is some of what I'm using to do this. I'd appreciate any help here. Is there any alternative package to HTTP that has a keep alive option? Can I somehow reuse the same connection with the default HTTP package? Thanks.
var msg1 = Ntlm.createMessage1(hostname);
HTTP.get(url, {
headers: {
"Authorization": "NTLM " + msg1.toBase64()
}
}, function (error, result) {
if (result != null) {
var response = result.headers["www-authenticate"];
var msg2 = Ntlm.decodeMessage2(response);
//here I should respond to msg2 on same kept-alive connection, but I'm not, so it's failing
var msg3 = Ntlm.createMessage3(msg2, hostname);
HTTP.get(url, {
headers: {
"Authorization": "NTLM " + msg3.toBase64()
}
}, function (error, req) {
if (req != null) {
if (req.statusCode == 200) {
Ntlm.authorized = true; //success
} else {
//error, what I'm getting now
//"401 - Unauthorized: Access is denied due to invalid credentials"
}
} else Ntlm.error(error);
});
} else Ntlm.error(error);
});
I don't think you can keep alive a connection with the default meteor http package. However, there are extensions and replacements to this default package. One of them that seems to support setting keepalive to true is this called http-more. There is more info about this package "requests" support here: https://github.com/request/request#requestoptions-callback
I have not been able to get Angular $http to communicate with a remote REST service. I have tried Restangular and $resource too. The problem seems to be with the underlying $http service and CORS limitations. I think I just need to get my headers right. Do I also need to tweak my server config?
I am getting the following error:
XMLHttpRequest cannot load http://www.EXAMPLE-DOMAIN.com/api/v2/users/sign_in. No 'Access-Control- Allow-Origin' header is present on the requested resource. Origin 'http://localhost:8100' is therefore not allowed access.
I have researched this a lot. Currently I have tried setting the $httpProvider headings when configuring my app module and played with $http headers. Below is some of my current code.
My Service
app.service('Auth', function($http) {
var headers = {
'Access-Control-Allow-Origin' : '*',
'Access-Control-Allow-Methods' : 'POST, GET, OPTIONS, PUT',
'Content-Type': 'application/json',
'Accept': 'application/json'
};
return $http({
method: "POST",
headers: headers,
url: 'http://www.EXAMPLE-DOMAINcom/api/v2/users/sign_in',
data: {"email":"my#email.com","password":"secret"}
}).success(function(result) {
console.log("Auth.signin.success!")
console.log(result);
}).error(function(data, status, headers, config) {
console.log("Auth.signin.error!")
console.log(data);
console.log(status);
console.log(headers);
console.log(config);
});
});
App Config
var app = angular.module('starter', ['ionic', 'app.controllers', $httpProvider])
.config(['$httpProvider', function($httpProvider) {
$httpProvider.defaults.useXDomain = true;
$httpProvider.defaults.headers.common = 'Content-Type: application/json';
delete $httpProvider.defaults.headers.common['X-Requested-With'];
}
])
If you are in control of the server, you might need to set the required headers there. Depending on which server, this might help: http://enable-cors.org/server.html