The courtesyredirectoverride from ekus

ekus / courtesyredirectoverride Goto Github PK

View Code? Open in Web Editor NEW

Prevents IIS from issuing a courtesy redirect when URL is lacking the trailing slash. This module performs the same function, but uses it using 302 response and RELATIVE path instead of 301 response with ABSOLUTE path issued by IIS.

License: MIT License

C# 100.00%

courtesyredirectoverride's People

Contributors

Stargazers

Watchers

courtesyredirectoverride's Issues

Still leaks internal IP in some cases

This module passes a URL without hostname to Response.Redirect(...), but HttpResponse.Redirect() still has logic that sometimes adds the domain name.

internal void Redirect(String url, bool endResponse, bool permanent) {
    (...)
    url = ConvertToFullyQualifiedRedirectUrlIfRequired(url);
    (...)
}

Source: https://github.com/microsoft/referencesource/blob/master/System.Web/HttpResponse.cs#L2372

Steps to reproduce, using powershell, openssl and HTTP/1.0:

Write-Output "GET /MyApp HTTP/1.0`n`n" | openssl s_client -host localhost -port 443
(...)
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
Location: https://[::1]/MyApp/
Server: Microsoft-IIS/10.0
X-Test: CourtesyRedirectOverride by .net module
(...)

Recommend Projects