Groups | Blog | Home
all groups > iis security > november 2003 >

iis security : isapi filter cookie


ptr1024 NO[at]SPAM yahoo.com
11/7/2003 9:56:33 AM
Hi,

I am developing a pay-per-view web based application. I am writing an
ISAPI filter that handles the security issues. When a user requests a
page with embedded media file located in a particular directory the
ISAPI checks whether the request came from a proper place by checking
cookies. If verified the file is passed through. Otherwise the user is
redirected to a signin page.

This works well for html and image files but not for the media files.
I noticed that when a request for a media file is processed the
cookies are not accessible. I reckon that this is due to the fact that
the request comes from the application (ie windows media player)
rather than browser and therefore the cookies are not passed.

Has anyone dealt with a similar situation? Is there a work around?
Would greatly appreciate your comments.

best regards

David Wang [Msft]
11/7/2003 1:59:17 PM
Cookies is primarily client-driven phenomenon over HTTP ( i.e. you're not
going to find cookies specified in the HTTP spec), so if you have a client
which does not support cookies... you're out of luck trying to use it.

Are you sure the problem is that the client does not support cookies, or is
the problem that your server is returning a cookie when the client knows it
never set a cookie (so it rejected it on security grounds)?

I think you're going to have to find another means of storing state --
perhaps you can keep a list of authenticated IP-addresses on the server and
redirect those that haven't logged in (i.e. transform the initial login
cookie into an IP stored on the server).

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Hi,

I am developing a pay-per-view web based application. I am writing an
ISAPI filter that handles the security issues. When a user requests a
page with embedded media file located in a particular directory the
ISAPI checks whether the request came from a proper place by checking
cookies. If verified the file is passed through. Otherwise the user is
redirected to a signin page.

This works well for html and image files but not for the media files.
I noticed that when a request for a media file is processed the
cookies are not accessible. I reckon that this is due to the fact that
the request comes from the application (ie windows media player)
rather than browser and therefore the cookies are not passed.

Has anyone dealt with a similar situation? Is there a work around?
Would greatly appreciate your comments.

best regards

peter

Jerry III
11/7/2003 4:04:54 PM
Just use simple url rewriting - embed the value of the cookie in the url
used by media player and strip it out in your filter in preproc headers or
redirect the client to the login page or even better, send an access denied
error to the client (as media player probably won't be able to display the
login page).

Jerry

[quoted text, click to view]

ptr1024 NO[at]SPAM yahoo.com
11/10/2003 2:17:56 AM
Thanks Jerry. that's what I thought...

peter


[quoted text, click to view]
ptr1024 NO[at]SPAM yahoo.com
11/17/2003 5:05:07 AM
I have yet another problem with the filter and the media files which i
cannot figure out...

A media file is <EMBEDed into an html page. Bellow is a simple snippet
of OnPreprocHeaders code.

This is what happens:

* when I just pass the url to the media file through the filter AND
the url does not contain a query string after the file name (eg
/test.wma) it works fine with either 7 or 9 versions of WMP
* when I pass the url through the filter BUT the url contains query
string (eg /test.wma?v=12345) it fails when accessed via WMP7 (i am
getting 'The page cannot be displayed') but works when accessed from a
machine with WMP9 installed
* when I GetHeader("url") and then SetHeader("url") on
OnPreprocHeaders without modifying the url I can access it from WMP9
but not WMP7 (regardless whether a query string is present or not).
* this problem does not relate to html, gif, jpeg files

Is there some extra information that have to be passed in the header
for older WMPs? I tried to add
pCtxt->m_pFC->AddResponseHeaders(pCtxt->m_pFC, "Content-type =
application/x-mplayer2\r\n\r\n", 0); in OnPreprocHeaders but still the
same problem.

I would greatly appreciate any help or suggestions

many thanks

peter

PS using the code bellow I can access media files using WMP9 but not
WMP7



DWORD COvumFltrFilter::OnPreprocHeaders(CHttpFilterContext* pCtxt,
PHTTP_FILTER_PREPROC_HEADERS pHeaderInfo)
{
char pUrl[1024];
LPDWORD pBufLen = new DWORD;
char* pTmp = 0;

*pBufLen = (DWORD)1024;

for(int i=0; i<1024; i++)
pUrl[i] = 0;

pHeaderInfo->GetHeader(pCtxt->m_pFC, "url", pUrl, pBufLen);

if(strstr(pUrl, ".wma")){
if(pTmp=strstr(pUrl, "?"))
*pTmp = '\0';

pHeaderInfo->SetHeader(pCtxt->m_pFC, "url", pUrl);
}


delete pBufLen;

return SF_STATUS_REQ_NEXT_NOTIFICATION;
}





[quoted text, click to view]
AddThis Social Bookmark Button