I have azure function app, where I want to use proxy to show static page to the users(which is hosted on another domain) after accessing the function app link like example below
https://myfunctionapp1.azurewebsites.net/
{
"$schema": "http://json.schemastore.org/proxies",
"proxies": {
"default": {
"matchCondition": {
"methods": [
"GET"
],
"route": "/"
},
"backendUri": "https://my-site.azurewebsites.net/default.htm"
}
}
}
The above configuration I have done a year ago showing up the static page on same url, but now when I access the link https://myfunctionapp1.azurewebsites.net/ it is redirecting to https://my-site.azurewebsites.net/default.htm
Is there any new changes to azure function proxy documentation? If so please refer the link here
Thanks & Regards
I encountered a similar issue where the function proxy redirects the browser to the backend URI instead of showing the results from the backend URI on the proxy URL.
It turns out that if the backend URI replies with a 301 or 302 redirect the proxy will return this redirect to the user's browser and therefore the browser will perform a redirect instead of just showing the contents of the backend URI.
In my case this 301 redirect was caused by the backend URI being https://[domain].com which performed a redirect to https://www.[domain].com.
Changing my backend URI to be https://www.[domain].com fixed the issue and it is now working as intended.
Related
Updating details to understand more: *In my project, user uploads html themes. For each user, if they authenticate, I am creating a public static folder for authenticated user in the same theme folder they are requesting. Then there is a editor in the front end where they can edit html theme contents. I am trying to show html themes in the editor using a iframe using the static link from backend. But the problem is I can't add script to the html theme in the iframe. It's saying permission denied. How can I solve this problem?
I am using express in backend and nextjs in frontend. I have added this code in helmet middleware.
app.use(
helmet({
contentSecurityPolicy: {
directives: {
'connect-src': ["'self'", 'http://localhost:3000'],
'default-src': "'self'",
'frame-ancestors': ["'self'", 'http://localhost:3000'],
sandbox: ['allow-forms', 'allow-scripts'],
'script-src': ["'self'", 'http://localhost:3000'],
},
},
})
);
For cross site scripting,
app.use(xss())
But still getting error in iframe.
From Backend I am trying to allow a route to be use in iframe in the frontend. Since, both server have different port in localhost, it's violating cross site embed and scripting. So, I am using helmet and xss package. I need help to configure it.
I am using iframe's onload attribute to check if it is loaded and then injecting another script to the iframe from frontend.
You have an issue of Same Origin Policy, not with Content Security Policy. Helmet package can't help you.
Set the value document.domain = 'example.com'; (example.com = 'localhost' in your case) both in the iframe and in the main page. It will reset port number to null and subdomain any.example.com to domain example.com, see test.
If both iframe and main page are on the same domain, you can just set document.domain = document.domain;.
Both variants leads resetting port number to null. therefore yoy'll be able to acces iframe with a different port number.
I have been transitioning to NextJS from CRA. I'm re-implementing authentication using SSR, and I would like to use NextJS built-in API routes to set HTTPOnly cookies.
There is a weird problem where my backend base URL is https://somesite.com/api and my frontend's - https://somesite.com/. This means that NextJS built-in API routes will be in conflict with my own backend.
I have been researching online and couldn't find any way on changing routing in NextJS, and I don't want to change base URL of my backend, since there are other services depending on it.
Has anyone had the same issue? How can I resolve this issue?
Try next.js rewrite
Rewrites allow you to map an incoming request path to a different destination path. Docs
Check Live Example here: https://stackblitz.com/edit/nextjs-rewrite
If Path is /api it'll point to JSON placeholder APIs.(ex. /api/todos)
module.exports = {
async rewrites() {
return [
{
source: '/api/:slug*',
destination: 'https://jsonplaceholder.typicode.com/:slug*'
}
];
}
};
I currently have two web apps that are set up in cloudflare with the following CNAMEs. Both are keystonejs applications.
app1.example.com ===pointing to ===> AWS ALB 1
app2.example.com ===pointing to ===> AWS ALB 2
I have Cloudflare Enterprise set up, so i'm able to use the "Render Override" feature in my page rules. I have 2 page rules set up using the following:
www.example.com ===render override ===> app1.example.com
www.example.com/app2/* ===render override ===> app2.example.com
Now in order to access the keystonejs application on app2.example.com. The application is called using app2.example.com/pa
The problem that i'm facing is that render override doesnt allow me to use sub paths, and i do not want to use the forwarding rule. Do i need to make my keystone application accessible through the root url, namely app2.example.com/ ? or is there another way to do this? Otherwise, would i need to use a reverse proxy? such as nginx ?
Thanks
Note: Since you are an enterprise customer, I highly recommend contacting your Customer Success Manager and/or Solutions Engineer at Cloudflare. They are there to help with exactly these kinds of questions. That said, I'll answer the question here for the benefit of self-serve customers.
I think when you say "Render Override" you actually mean "Resolve Override". This setting changes the DNS lookup for the request such that it is routed to a different origin IP address than it would be normally.
Note that Resolve Override does not rewrite the request in any way; it only routes it to a different server. So, a request to www.example.com/app2/foo will go to the server app2.example.com, but the path will still be /app2/foo (not /foo), and the Host header will still be Host: www.example.com.
It sounds like in your case you really want /app2/* to be rewritten to /pa/*, in addition to redirecting to a different origin. You can accomplish this using Cloudflare Workers, which lets you execute arbitrary JavaScript on Cloudflare's edge. Here's what the script might look like:
addEventListener("fetch", event => {
event.respondWith(handle(event.request));
});
async function handle(request) {
let url = new URL(request.url) // parse the URL
if (url.pathname.startsWith("/app2/")) {
// Override the target hostname.
url.host = "app2.example.com"
// Replace /app2/ with /pb/ in the path.
url.pathname = "/pb/" + url.pathname.slice("/app2/".length)
// Send the request on to origin.
return fetch(url, request)
} else {
// Just override the hostname.
url.host = "app1.example.com"
// Send the request on to origin.
return fetch(url, request)
}
}
With this deployed, you can remove your Resolve Override page rules, as they are now covered by the Worker script.
Note that the above script actually does rewrite the Host header in addition to the path. If you want the Host header to stay as www.example.com, then you will need to use the cf.resolveOverride option. This is only available to enterprise customers; ask your CSM or SE if you need help using it. But, for most cases, you actually want the Host header to be rewritten, so you probably don't need this.
I have an application developed in Servlets and JSPs.
But here is my issue:
Without logging in I don't want any JSP to be rendered. When I request a particular URL(some JSP) my code should authenticate it and if fails it should be redirected to login page and once login is successful then previously requested page should be automatically redirected.
Which usually happens in most of the websites.
How do we achieve this Servlets and JSPs.
Thank you and Regards
You could pass the original request url as a parameter to your redirect url and once the redirect action is complete on the server side (after authentication), retrieve the url from the request param and redirect or forward to it.
Original request
-----------------
if(!authenticated){
response.sendRedirect("/authURL?originalURL=somepath");
}
Authentication Request
---------------------
if(authenticationSuccessful){
String originalURL = request.getParam("originalURL");
if(originalURL != null){
response.sendRedirect("/originalURL");
}
}
Another way is to set a cookie with the redirect. The cookie value can contain the original url.
How do I force ASP.NET Web.API to generate HTTPS links?
In my MVC app, I am generating urls in the views this way #Url.HttpRouteUrl("DefaultApi", new { controller = "People" })
But if the web app is accessed through HTTP, the links will use the HTTP schema. I want to force the HTTPS for the connections to the Web API.
I know there are examples of the RequireHttpsAttribute in internet, but those examples just refuse the connection if HTTPS is required and not provided, what is fine. What I want is that even if the app is accessed through HTTP, the links to the Web API be generated with the HTTPS schema.
Cheers.
You could use the RouteUrl method which allows you so specify the protocol and thus generate an absolute URL with this protocol:
#Url.RouteUrl(
"DefaultApi",
new { httproute = "", controller = "People" },
"https"
)
Notice the httproute = "" route value to indicate that we want to generate a route for a Web API controller and not MVC controller.