IIRF does not work with PDFs?

Topics: Developer Forum, User Forum
Jan 8, 2010 at 8:10 PM

A little backgound on the issue I've uncovered.  We have a protected members area and want to prevent leeching of the PDF's that are contained within this area.  In testing IIRF, we're seeing odd results of the filter allowing the request through (no rewrite) but then immediatley following up by rerunning the rule, even with IterationLimit set to 1.  Since we are using HTTP_REFFERER, the second attempt always fails as the HTTP_REFERRER is lost after the first request.

Some "proof in the pudding".  The site name, paths, and PDF names have been replaced by dummy names.  This is the log, level 3, on a Win2k3 Server (IIS6).  The result of this issue is that the PDF will begin streaming momentarily (~100KB) and then stop when it should be allowed to persist the download.  The log file was from one click on a legitimate PDF download from our site.  Suggestions or ideas, or should this be put in the Issue Tracker?

Fri Jan 08 11:53:08 -   532 - ReadSiteConfig: actual log file 'C:\Temp\IIRF\iirf.2784.log'
Fri Jan 08 11:53:08 -   532 - ReadSiteConfig: ini file: 'C:\Inetpub\mysite\Iirf.ini'
Fri Jan 08 11:53:08 -   532 - ReadSiteConfig: ini file timestamp: 2010/01/08 11:53:03 Pacific Standard Time
Fri Jan 08 11:53:08 -   532 - ReadSiteConfig: line  10: LogLevel = 3
Fri Jan 08 11:53:08 -   532 - ReadSiteConfig: line  14: RewriteCond   %{HTTP_REFERER}  !^https?://(?:www\.)mysite\.com/
Fri Jan 08 11:53:08 -   532 - ParseCondModifierFlags: '[I,L]'
Fri Jan 08 11:53:08 -   532 - WARNING: unsupported RewriteCond modifier flag 'L'
Fri Jan 08 11:53:08 -   532 - ReadSiteConfig: line  16: RewriteRule (rule 1)  '\.(?:pdf|flv)$'  '/error/403.htm'    [I,L]
Fri Jan 08 11:53:08 -   532 - ReadSiteConfig: Done reading, found 1 rules (0 errors, 0 warnings) on 20 lines
Fri Jan 08 11:53:08 -   532 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:08 -   532 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:08 -   532 - HttpFilterProc: SF_NOTIFY_LOG
Fri Jan 08 11:53:09 -   532 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:09 -   532 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:09 -   532 - HttpFilterProc: SF_NOTIFY_LOG
Fri Jan 08 11:53:09 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:09 -  1892 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:09 -  1892 - HttpFilterProc: SF_NOTIFY_AUTH_COMPLETE
Fri Jan 08 11:53:09 -  1892 - DoRewrites
Fri Jan 08 11:53:09 -  1892 - DoRewrites: Url (decoded): '/download/pdf/test.pdf'
Fri Jan 08 11:53:09 -  1892 - EvaluateRules: depth=0
Fri Jan 08 11:53:09 -  1892 - EvaluateRules: Rule 1 : 1 matches
Fri Jan 08 11:53:09 -  1892 - EvalCondition: Cond %{HTTP_REFERER} !^https?://(?:www\.)mysite\.com/ => FALSE
Fri Jan 08 11:53:09 -  1892 - EvalConditionList: rule 1, FALSE, Rule does not apply
Fri Jan 08 11:53:09 -  1892 - EvaluateRules: returning 0
Fri Jan 08 11:53:09 -  1892 - DoRewrites: No Rewrite

Fri Jan 08 11:53:09 -  1892 - HttpFilterProc: SF_NOTIFY_LOG
Fri Jan 08 11:53:09 -   532 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:09 -   532 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:09 -  1892 - HttpFilterProc: SF_NOTIFY_LOG
Fri Jan 08 11:53:09 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:09 -  1892 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:09 -   532 - HttpFilterProc: SF_NOTIFY_LOG
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: SF_NOTIFY_LOG
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: SF_NOTIFY_AUTH_COMPLETE
Fri Jan 08 11:53:10 -  1892 - DoRewrites
Fri Jan 08 11:53:10 -  1892 - DoRewrites: Url (decoded): '/download/pdf/test.pdf'
Fri Jan 08 11:53:10 -  1892 - EvaluateRules: depth=0
Fri Jan 08 11:53:10 -  1892 - EvaluateRules: Rule 1 : 1 matches
Fri Jan 08 11:53:10 -  1892 - GetServerVariable: cannot find that variable
Fri Jan 08 11:53:10 -  1892 - EvalCondition: Cond %{HTTP_REFERER} !^https?://(?:www\.)mysite\.com/ => TRUE
Fri Jan 08 11:53:10 -  1892 - EvalConditionList: rule 1, TRUE, Rule will apply
Fri Jan 08 11:53:10 -  1892 - EvaluateRules: Result (length 12): /error/403.htm
Fri Jan 08 11:53:10 -  1892 - EvaluateRules: Last Rule
Fri Jan 08 11:53:10 -  1892 - EvaluateRules: returning 1
Fri Jan 08 11:53:10 -  1892 - DoRewrites: Rewrite Url to: '/error/403.htm'
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: SF_NOTIFY_LOG
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -  1892 - HttpFilterProc: SF_NOTIFY_LOG
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: SF_NOTIFY_AUTH_COMPLETE
Fri Jan 08 11:53:10 -   532 - DoRewrites
Fri Jan 08 11:53:10 -   532 - DoRewrites: Url (decoded): '/download/pdf/test.pdf'
Fri Jan 08 11:53:10 -   532 - EvaluateRules: depth=0
Fri Jan 08 11:53:10 -   532 - EvaluateRules: Rule 1 : 1 matches
Fri Jan 08 11:53:10 -   532 - GetServerVariable: cannot find that variable
Fri Jan 08 11:53:10 -   532 - EvalCondition: Cond %{HTTP_REFERER} !^https?://(?:www\.)mysite\.com/ => TRUE
Fri Jan 08 11:53:10 -   532 - EvalConditionList: rule 1, TRUE, Rule will apply
Fri Jan 08 11:53:10 -   532 - EvaluateRules: Result (length 12): /error/403.htm
Fri Jan 08 11:53:10 -   532 - EvaluateRules: Last Rule
Fri Jan 08 11:53:10 -   532 - EvaluateRules: returning 1
Fri Jan 08 11:53:10 -   532 - DoRewrites: Rewrite Url to: '/error/403.htm'
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: cfg= 0x01CC3FB0
Fri Jan 08 11:53:10 -   532 - HttpFilterProc: SF_NOTIFY_LOG

Coordinator
Jan 8, 2010 at 9:28 PM

I see 3 requests arriving at IIRF.

For the first request, the rewrite rule does not apply.   (IIRF believes that HTTP_REFERER is set.)

For the 2nd and 3rd requests, the rule applies. 

This doesn't look like an error to me, just based on that log.

Why there are 3 requests, I don't know.  I'm not familiar with the transaction flow for a downloadable document. I assumed it would be a single request.  I suggest you hook up Fiddler2 to figure out where the 3 requests are coming from.  you may also want to turn IIRF logging to 4 to see the method used for that request.

 

 

 

Jan 8, 2010 at 10:19 PM

Will this help (logging set to 5)?

Fri Jan 08 14:08:55 -  3588 - IsIniFileUpdated: C:\Inetpub\mysite\Iirf.ini NO
Fri Jan 08 14:08:55 -  3588 - GetSiteConfig: Obtain  site '/LM/W3SVC/1999690264/Root' (era=0) (rc=1) (Expired=0) (ptr=0x03834BE0)...
Fri Jan 08 14:08:55 -  3588 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 14:08:55 -  3588 - HttpFilterProc: cfg= 0x03834BE0
Fri Jan 08 14:08:55 -  3588 - HttpFilterProc: SF_NOTIFY_AUTH_COMPLETE
Fri Jan 08 14:08:55 -  3588 - DoRewrites
Fri Jan 08 14:08:55 -  3588 - GetServerVariable_AutoFree: getting 'url'
Fri Jan 08 14:08:55 -  3588 - GetServerVariable_AutoFree: 128 bytes
Fri Jan 08 14:08:55 -  3588 - GetServerVariable_AutoFree: result ''
Fri Jan 08 14:08:55 -  3588 - GetHeader_AutoFree: getting 'url'
Fri Jan 08 14:08:55 -  3588 - GetHeader_AutoFree: 44 bytes   ptr:0x00146FB0
Fri Jan 08 14:08:55 -  3588 - GetHeader_AutoFree: 'url' = '/download/pdf/test.pdf'
Fri Jan 08 14:08:55 -  3588 - GetServerVariable_AutoFree: getting 'QUERY_STRING'
Fri Jan 08 14:08:55 -  3588 - GetServerVariable_AutoFree: 1 bytes
Fri Jan 08 14:08:55 -  3588 - GetServerVariable_AutoFree: result ''
Fri Jan 08 14:08:55 -  3588 - GetHeader_AutoFree: getting 'method'
Fri Jan 08 14:08:55 -  3588 - GetHeader_AutoFree: 4 bytes   ptr:0x001470C0
Fri Jan 08 14:08:55 -  3588 - GetHeader_AutoFree: 'method' = 'GET'
Fri Jan 08 14:08:55 -  3588 - DoRewrites: New Url, before decoding: '/download/pdf/test.pdf'
Fri Jan 08 14:08:55 -  3588 - DoRewrites: Url (decoded): '/download/pdf/test.pdf'
Fri Jan 08 14:08:55 -  3588 - EvaluateRules: depth=0
Fri Jan 08 14:08:55 -  3588 - EvaluateRules: Rule 1 : 1 matches
Fri Jan 08 14:08:55 -  3588 - GetServerVariable: getting 'HTTP_REFERER'
Fri Jan 08 14:08:55 -  3588 - GetServerVariable: 27 bytes
Fri Jan 08 14:08:55 -  3588 - GetServerVariable: result 'http://www.mysite.com/'
Fri Jan 08 14:08:55 -  3588 - ReplaceServerVariables: VariableName='HTTP_REFERER' Value='http://www.mysite.com/'
Fri Jan 08 14:08:55 -  3588 - ReplaceServerVariables: in='%{HTTP_REFERER}' out='http://www.mysite.com/'
Fri Jan 08 14:08:55 -  3588 - EvalCondition: ts1 'http://www.mysite.com/'
Fri Jan 08 14:08:55 -  3588 - GenerateReplacementString: result 'http://www.mysite.com/'
Fri Jan 08 14:08:55 -  3588 - EvalCondition: checking 'http://www.mysite.com/' against pattern '!^https?://(?:www\.)mysite\.com/'
Fri Jan 08 14:08:55 -  3588 - EvalCondition: match result: 1 (match)
Fri Jan 08 14:08:55 -  3588 - EvalCondition: Cond %{HTTP_REFERER} !^https?://(?:www\.)mysite\.com/ => FALSE
Fri Jan 08 14:08:55 -  3588 - EvalConditionList: rule 1, FALSE, Rule does not apply
Fri Jan 08 14:08:55 -  3588 - EvaluateRules: returning 0
Fri Jan 08 14:08:55 -  3588 - DoRewrites: No Rewrite
Fri Jan 08 14:08:56 -  3588 - IsIniFileUpdated: C:\Inetpub\mysite\Iirf.ini NO
Fri Jan 08 14:08:56 -  3588 - GetSiteConfig: Obtain  site '/LM/W3SVC/1999690264/Root' (era=0) (rc=2) (Expired=0) (ptr=0x03834BE0)...
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: cfg= 0x03834BE0
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: SF_NOTIFY_AUTH_COMPLETE
Fri Jan 08 14:08:56 -  3588 - DoRewrites
Fri Jan 08 14:08:56 -  3588 - GetServerVariable_AutoFree: getting 'url'
Fri Jan 08 14:08:56 -  3588 - GetServerVariable_AutoFree: 128 bytes
Fri Jan 08 14:08:56 -  3588 - GetServerVariable_AutoFree: result ''
Fri Jan 08 14:08:56 -  3588 - GetHeader_AutoFree: getting 'url'
Fri Jan 08 14:08:56 -  3588 - GetHeader_AutoFree: 44 bytes   ptr:0x001473E8
Fri Jan 08 14:08:56 -  3588 - GetHeader_AutoFree: 'url' = '/download/pdf/test.pdf'
Fri Jan 08 14:08:56 -  3588 - GetServerVariable_AutoFree: getting 'QUERY_STRING'
Fri Jan 08 14:08:56 -  3588 - GetServerVariable_AutoFree: 1 bytes
Fri Jan 08 14:08:56 -  3588 - GetServerVariable_AutoFree: result ''
Fri Jan 08 14:08:56 -  3588 - GetHeader_AutoFree: getting 'method'
Fri Jan 08 14:08:56 -  3588 - GetHeader_AutoFree: 4 bytes   ptr:0x00151008
Fri Jan 08 14:08:56 -  3588 - GetHeader_AutoFree: 'method' = 'GET'
Fri Jan 08 14:08:56 -  3588 - DoRewrites: New Url, before decoding: '/download/pdf/test.pdf'
Fri Jan 08 14:08:56 -  3588 - DoRewrites: Url (decoded): '/download/pdf/test.pdf'
Fri Jan 08 14:08:56 -  3588 - EvaluateRules: depth=0
Fri Jan 08 14:08:56 -  3588 - EvaluateRules: Rule 1 : 1 matches
Fri Jan 08 14:08:56 -  3588 - GetServerVariable: getting 'HTTP_REFERER'
Fri Jan 08 14:08:56 -  3588 - GetServerVariable: cannot find that variable

Fri Jan 08 14:08:56 -  3588 - GetServerVariable: 128 bytes
Fri Jan 08 14:08:56 -  3588 - GetServerVariable: result 'HTTP_REFERER'
Fri Jan 08 14:08:56 -  3588 - ReplaceServerVariables: VariableName='HTTP_REFERER' Value='HTTP_REFERER'
Fri Jan 08 14:08:56 -  3588 - ReplaceServerVariables: in='%{HTTP_REFERER}' out='HTTP_REFERER'
Fri Jan 08 14:08:56 -  3588 - EvalCondition: ts1 'HTTP_REFERER'
Fri Jan 08 14:08:56 -  3588 - GenerateReplacementString: result 'HTTP_REFERER'
Fri Jan 08 14:08:56 -  3588 - EvalCondition: checking 'HTTP_REFERER' against pattern '!^https?://(?:www\.)mysite\.com/'
Fri Jan 08 14:08:56 -  3588 - EvalCondition: match result: -1 (No match)
Fri Jan 08 14:08:56 -  3588 - EvalCondition: Cond %{HTTP_REFERER} !^https?://(?:www\.)mysite\.com/ => TRUE
Fri Jan 08 14:08:56 -  3588 - EvalConditionList: rule 1, TRUE, Rule will apply
Fri Jan 08 14:08:56 -  3588 - ReplaceServerVariables: in='/error/403.htm' out='/error/403.htm'
Fri Jan 08 14:08:56 -  3588 - GenerateReplacementString: result '/error/403.htm'
Fri Jan 08 14:08:56 -  3588 - EvaluateRules: Result (length 12): /error/403.htm
Fri Jan 08 14:08:56 -  3588 - EvaluateRules: Last Rule
Fri Jan 08 14:08:56 -  3588 - EvaluateRules: returning 1
Fri Jan 08 14:08:56 -  3588 - DoRewrites: Rewrite Url to: '/error/403.htm'
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: cfg= 0x03834BE0
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: cfg= 0x03834BE0
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: cfg= 0x03834BE0
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: cfg= 0x03834BE0
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: SF_NOTIFY_LOG
Fri Jan 08 14:08:56 -  3588 - ReleaseOrExpireSiteConfig: site '/LM/W3SVC/1999690264/Root' (era=0) (rc=1) (Expired=0) (ptr=0x03834BE0)...
Fri Jan 08 14:08:56 -  3588 - HttpFilterProc: SF_NOTIFY_LOG
Fri Jan 08 14:08:56 -  3588 - ReleaseOrExpireSiteConfig: site '/LM/W3SVC/1999690264/Root' (era=0) (rc=0) (Expired=0) (ptr=0x03834BE0)...
Fri Jan 08 14:08:56 -  1892 - IsIniFileUpdated: C:\Inetpub\mysite\Iirf.ini NO
Fri Jan 08 14:08:56 -  1892 - GetSiteConfig: Obtain  site '/LM/W3SVC/1999690264/Root' (era=0) (rc=1) (Expired=0) (ptr=0x03834BE0)...
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: cfg= 0x03834BE0
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: SF_NOTIFY_AUTH_COMPLETE
Fri Jan 08 14:08:56 -  1892 - DoRewrites
Fri Jan 08 14:08:56 -  1892 - GetServerVariable_AutoFree: getting 'url'
Fri Jan 08 14:08:56 -  1892 - GetServerVariable_AutoFree: 128 bytes
Fri Jan 08 14:08:56 -  1892 - GetServerVariable_AutoFree: result ''
Fri Jan 08 14:08:56 -  1892 - GetHeader_AutoFree: getting 'url'
Fri Jan 08 14:08:56 -  1892 - GetHeader_AutoFree: 44 bytes   ptr:0x00135898
Fri Jan 08 14:08:56 -  1892 - GetHeader_AutoFree: 'url' = '/download/pdf/test.pdf'
Fri Jan 08 14:08:56 -  1892 - GetServerVariable_AutoFree: getting 'QUERY_STRING'
Fri Jan 08 14:08:56 -  1892 - GetServerVariable_AutoFree: 1 bytes
Fri Jan 08 14:08:56 -  1892 - GetServerVariable_AutoFree: result ''
Fri Jan 08 14:08:56 -  1892 - GetHeader_AutoFree: getting 'method'
Fri Jan 08 14:08:56 -  1892 - GetHeader_AutoFree: 4 bytes   ptr:0x0011AE20
Fri Jan 08 14:08:56 -  1892 - GetHeader_AutoFree: 'method' = 'GET'
Fri Jan 08 14:08:56 -  1892 - DoRewrites: New Url, before decoding: '/download/pdf/test.pdf'
Fri Jan 08 14:08:56 -  1892 - DoRewrites: Url (decoded): '/download/pdf/test.pdf'
Fri Jan 08 14:08:56 -  1892 - EvaluateRules: depth=0
Fri Jan 08 14:08:56 -  1892 - EvaluateRules: Rule 1 : 1 matches
Fri Jan 08 14:08:56 -  1892 - GetServerVariable: getting 'HTTP_REFERER'
Fri Jan 08 14:08:56 -  1892 - GetServerVariable: cannot find that variable
Fri Jan 08 14:08:56 -  1892 - GetServerVariable: 128 bytes
Fri Jan 08 14:08:56 -  1892 - GetServerVariable: result 'HTTP_REFERER'
Fri Jan 08 14:08:56 -  1892 - ReplaceServerVariables: VariableName='HTTP_REFERER' Value='HTTP_REFERER'
Fri Jan 08 14:08:56 -  1892 - ReplaceServerVariables: in='%{HTTP_REFERER}' out='HTTP_REFERER'
Fri Jan 08 14:08:56 -  1892 - EvalCondition: ts1 'HTTP_REFERER'
Fri Jan 08 14:08:56 -  1892 - GenerateReplacementString: result 'HTTP_REFERER'
Fri Jan 08 14:08:56 -  1892 - EvalCondition: checking 'HTTP_REFERER' against pattern '!^https?://(?:www\.)mysite\.com/'
Fri Jan 08 14:08:56 -  1892 - EvalCondition: match result: -1 (No match)
Fri Jan 08 14:08:56 -  1892 - EvalCondition: Cond %{HTTP_REFERER} !^https?://(?:www\.)mysite\.com/ => TRUE
Fri Jan 08 14:08:56 -  1892 - EvalConditionList: rule 1, TRUE, Rule will apply
Fri Jan 08 14:08:56 -  1892 - ReplaceServerVariables: in='/error/403.htm' out='/error/403.htm'
Fri Jan 08 14:08:56 -  1892 - GenerateReplacementString: result '/error/403.htm'
Fri Jan 08 14:08:56 -  1892 - EvaluateRules: Result (length 12): /error/403.htm
Fri Jan 08 14:08:56 -  1892 - EvaluateRules: Last Rule
Fri Jan 08 14:08:56 -  1892 - EvaluateRules: returning 1
Fri Jan 08 14:08:56 -  1892 - DoRewrites: Rewrite Url to: '/error/403.htm'
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: cfg= 0x03834BE0
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: cfg= 0x03834BE0
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: cfg= 0x03834BE0
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: SF_NOTIFY_URL_MAP
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: cfg= 0x03834BE0
Fri Jan 08 14:08:56 -  1892 - HttpFilterProc: SF_NOTIFY_LOG
Fri Jan 08 14:08:56 -  1892 - ReleaseOrExpireSiteConfig: site '/LM/W3SVC/1999690264/Root' (era=0) (rc=0) (Expired=0) (ptr=0x03834BE0)...

Coordinator
Jan 8, 2010 at 10:30 PM
Edited Jan 8, 2010 at 10:31 PM

Yes, well it's clearer now what IIRF is seeing for HTTP_REFERER.   Nothing entirely new there, but it clarifies things somewhat. It also confirms that the METHOD is GET in all three cases.

But as to why there are 3 distinct requests - that is something that will be clearer only with client-side tracing (Fiddler).

 

Jan 12, 2010 at 6:44 PM

An update to the issue...

I have never used Fiddler before (Firebug and IE's new developers toolbar are my trades), but I've downloaded and installed it.  When I run Fiddler and capture traffic, I see that there are 3 requests being sent to the server due to the first two failing basic authentication (ding ding ding).  We don't allow anonymous basic auth to the testing portion of our website, where this is currently installed, so I'll have to make a few IIS configuration changes to continue testing.

Coordinator
Jan 12, 2010 at 8:26 PM
Edited Jan 12, 2010 at 8:26 PM

Fiddler explained why there are 3 requests. Great!

Thanks for the update!

Jan 13, 2010 at 3:14 PM
Edited Jan 13, 2010 at 3:15 PM

That indeed was the issue.  Once we allowed anonymous authentication to the testing website, it worked perfectly.  We're now running it in our live site to protect PDFs, ZIP files, EXE's, etc.  It's a great filter!  Thanks for the help and the Fiddler recommendation as well.

FYI - I know in the instructions it says that you need to restart IIS, but we managed to install everything and get it running the way it should without restarting (Win2k3 Server, IIS6).  Something that might be worth while pointing out in your documentation as it may scare away users with multiple large production websites in IIS that can't afford to do restart on a whim.

Coordinator
Jan 13, 2010 at 6:46 PM

Thanks for the additional update, the compliments, and the suggestion.

 

Coordinator
Jan 13, 2010 at 6:47 PM
This discussion has been copied to a work item. Click here to go to the work item and continue the discussion.