I have requirement where I blocked the access to files based on extension using below lines in Web.config file for IIS.
<system.webServer>
<security>
<requestFiltering>
<fileExtensions allowUnlisted="false">
<add fileExtension=".php" allowed="true" />
<add fileExtension=".js" allowed="true" />
<add fileExtension=".css" allowed="true" />
<add fileExtension=".png" allowed="true" />
<add fileExtension=".jpg" allowed="true" />
<add fileExtension=".gif" allowed="true" />
<add fileExtension=".jar" allowed="true" />
</fileExtensions>
</requestFiltering>
</security>
</system.webServer>
But these lines preventing the application from navigating to index.php (home page). How to resolve this problem?
Follow Lex Li's method would achieve your requirement. Besides, URL rewrite could provide another way to block all unlisted extension based on {PATH_INFO} variable.
<rule name="rewrite" enabled="true" stopProcessing="true">
<match url="(.*)" />
<conditions logicalGrouping="MatchAny">
<add input="{PATH_INFO}" pattern="\.(js|php|css|png|jpg|gif|jar)$" negate="true" />
</conditions>
<action type="AbortRequest" />
</rule>
Related
I have an IIS server in my network with a domain configured who based on some ARR rules on the web.config shows a wordpress that is installed with xaamp in other server in my network.
So when yo go to example.com it shows the wordpress that its in 192.168.110.104:8080
When I try to access to example.com from my network, seems like the rules works fine and the wordpress content it works properly but when I try to access to the domain example.com from the internet it shows a lot of errors as looks like it's trying to load 'internal resources' form internet? obviously it load without css styles, some images works, some not, so it's a mess.
Errors are timeout like this.
GET http://192.168.100.104:8080/wp-content/themes/astra/assets/css/minified/style.min.css?ver=2.4.4 net::ERR_CONNECTION_TIMED_OUT
In the wordpress I have configured the :
wordPress (URL) as http://192.168.100.104:8080
web url : http://192.168.100.104:8080
Maybe I have to place the domain there instead the local ip?
This is my web.config from the IIS
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<defaultDocument>
<files>
<add value="homepage.asp" />
</files>
</defaultDocument>
<cors enabled="true" failUnlistedOrigins="true">
<add origin="*">
<allowHeaders allowAllRequestedHeaders="true" />
</add>
</cors>
<rewrite>
<rules>
<rule name="ReverseProxyInboundRule1" stopProcessing="true">
<match url="(.*)" />
<action type="Rewrite" url="{C:1}://192.168.100.104:8080/{R:1}" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
<add input="{CACHE_URL}" pattern="^(https?)://" />
</conditions>
</rule>
</rules>
<outboundRules>
<rule name="ReverseProxyOutboundRule1" preCondition="ResponseIsHtml1">
<match filterByTags="A, Form, Img" pattern="^http(s)?://192.168.100.104:8080/(.*)" />
<action type="Rewrite" value="http{R:1}://example.com/{R:2}" />
</rule>
<preConditions>
<preCondition name="ResponseIsHtml1">
<add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
</preCondition>
</preConditions>
</outboundRules>
</rewrite>
<staticContent>
<clientCache cacheControlMode="NoControl" />
</staticContent>
<httpProtocol>
<customHeaders>
<add name="Access-Control-Allow-Origin" value="*" />
<add name="Access-Control-Allow-Methods" value="GET, PUT, POST, DELETE, HEAD, OPTIONS" />
<add name="Access-Control-Allow-Credentials" value="true" />
<add name="Access-Control-Allow-Headers" value="X-Requested-With, origin, content-type, accept" />
</customHeaders>
</httpProtocol>
</system.webServer>
</configuration>
Any ideas? thanks in advance!
I have put in this http redirectin the web config file but I keep getting a redirection loop. The website is a wordpress website and is being hosted on IIS7.5, it may also be worth metioning that I have a plug in called really simple ssl installed to handle the https redirects.
I will attach my web.config file below
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<staticContent>
<mimeMap fileExtension=".woff" mimeType="application/x-font-woff" />
</staticContent>
<rewrite>
<rules><rule name="Main Rule" stopProcessing="true"><match url=".*" />
<conditions logicalGrouping="MatchAll"><add input="{REQUEST_FILENAME}"
matchType="IsFile" negate="true" /><add input="{REQUEST_FILENAME}"
matchType="IsDirectory" negate="true" /></conditions><action
type="Rewrite" url="index.php" /></rule>
<rule name="WordPress: http://www.google.com"
patternSyntax="Wildcard">
<match url="*" />
<conditions>
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
</conditions>
<action type="Rewrite" url="index.php" />
</rule></rules>
</rewrite>
<httpRedirect enabled="true" destination="http://www.google.com" httpResponseStatus="Permanent" />
<security>
<requestFiltering>
<denyUrlSequences>
<add sequence="xmlrpc.php" />
</denyUrlSequences>
<requestLimits maxAllowedContentLength="50000000" />
</requestFiltering>
</security>
<handlers>
</handlers>
</system.webServer>
</configuration>
I have an Angular 4 app in a IIS server, in the same server there is a .NET Web API. They are in diferents folders: angular app is in "/wwwroot/angular/" and web api in "/wwwroot/api/". When I do a request to web api, it works successfully, but when I try to navigate to an URL different to index.html using the Routing Module in angular app I get this message:
500 - Internal server error.
There is a problem with the resource you are looking for, and it cannot be displayed.
Also, I have two Web.Config files -one in each folder-.
My Angular Web. Config is:
<system.webServer>
<rewrite>
<rules>
<rule name="Angular Routes" stopProcessing="true">
<match url=".*" />
<conditions logicalGrouping="MatchAll">
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true"/>
</conditions>
<action type="Rewrite" url="/index.html" />
</rule>
</rules>
</rewrite>
</system.webServer>
Web.config of WEB API
<configuration>
<system.webServer>
<handlers>
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<remove name="OPTIONSVerbHandler" />
<remove name="TRACEVerbHandler" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
</system.webServer>
</configuration>
I researched in some questions like:
stackoverflow.com/questions/49833141/blank-page-when-publishing-angular-5-net-core-web-api
and
stackoverflow.com/questions/42865084/redirect-unknown-requests-to-index-html-in-springboot
But they doesn't work to me.
Anybody help me on this.
Thanks in advance.
The solution was move all the Angular files to root, at index.html I left <base href="/"> and make the web.config like this:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rewriteMaps>
<rewriteMap name="^(.*)$" />
</rewriteMaps>
<rules>
<rule name="Angular Route" stopProcessing="true">
<match url="^(.*)$" />
<conditions logicalGrouping="MatchAll">
<add input="{REQUEST_URI}" pattern="/api(.*)$" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
</conditions>
<action type="Rewrite" url="/index.html" />
</rule>
</rules>
</rewrite>
<security>
<authorization>
<remove users="*" roles="" verbs="" />
<add accessType="Allow" users="?" />
</authorization>
</security>
</system.webServer>
</configuration>
In your web.config change <action type="Rewrite" url="/FIN360" /> and in your index.html from the <base href="/"> remove the / Try this else change <base href="./"> OR <base href="/FIN360">
I'm serving Confluence through IIS to end user, here is web.config:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<security>
<requestFiltering allowDoubleEscaping="True" />
</security>
<rewrite>
<rules>
<rule name="RewriteUserFriendlyURL" stopProcessing="false">
<match url="\+" />
<conditions>
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
</conditions>
<action type="Rewrite" url="{UrlDecode:{REQUEST_URI}}" />
</rule>
<rule name="inbound" stopProcessing="true">
<match url="(.*)" />
<action type="Rewrite" url="http://localhost:8090/{R:1}" />
</rule>
</rules>
</rewrite>
<handlers>
<remove name="WebServiceHandlerFactory-ISAPI-2.0-64" />
<remove name="WebServiceHandlerFactory-ISAPI-2.0" />
<remove name="PageHandlerFactory-ISAPI-2.0" />
<remove name="PageHandlerFactory-ISAPI-2.0-64" />
<remove name="PageHandlerFactory-Integrated" />
<remove name="WebServiceHandlerFactory-Integrated" />
<remove name="SimpleHandlerFactory-ISAPI-2.0-64" />
<remove name="SimpleHandlerFactory-ISAPI-2.0" />
<remove name="SimpleHandlerFactory-Integrated" />
<remove name="CGI-exe" />
<remove name="ISAPI-dll" />
</handlers>
</system.webServer>
</configuration>
Confluence runs in it's own process on port 8090
What I want is somehow add confluence as a subfolder to another site so it goes to:
site.com/confluence
site.com is ASP.NET website. I'd like to password-protect /confluence folder.
So, if user logged in to site.com (ASP.NET Membership provider) - they get access to /confluence folder.
Is this possible and how this should be done?
What you are asking for is Delegated Authentication of a IIS Reverse Proxy.
This is technically possible.
You don't want to do this. Because you would need to use ASP.Net authentication to view the website. But then you also need to log in using your confluence log in.
You actually want to use
IIS Reverse Proxy/Application Request Routing (this puts the Confluence website in the "subfolder")
Single Sign-on Integration with ASP.Net Membership.
https://confluence.atlassian.com/kb/single-sign-on-integration-with-the-atlassian-stack-794495126.html
With this solution, Confluence uses Crowd to connect to ASP.Net using OpenID.
I recommend using IdentityServer to expose your ASP.Net Membership Provider to the OpenID api.
I have a site that uses Worpress on part of it. I am having trouble with the index page.
With index.php the site loads the most recent posts, which is the desired action with the incorrect url. Without index.php, which is the desired url, the page loads the 404 template.
I have the site working locally correctly. The only thing I can think of, is the web.config is incorrectly routing this request. Since this is an area I don't deal well with, I was hoping to get some help to see if that was the issue.
Here is the web.config contents:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="Imported Rule 2-1" stopProcessing="true">
<match url="." ignoreCase="false" />
<conditions logicalGrouping="MatchAll">
<add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
</conditions>
<action type="Rewrite" url="index.php" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>
It sounds like you don't have index.php in the list of Default Documents. Add index.php to the list as shown below. You can also do this through the IIS settings for Default Document.
<defaultDocument>
<files>
<clear />
<add value="index.php" />
<add value="index.asp" />
<add value="Default.asp" />
<add value="Default.htm" />
<add value="index.htm" />
<add value="index.html" />
<add value="iisstart.htm" />
<add value="default.aspx" />
</files>
</defaultDocument>