I'm setting up a reverse proxy to limit access to a protected resource. The protected resource provides a status page (http://protected.local/info). That page contains a number of links with query strings in order to drill down (http://protected.local/info/detail.asp?zip=01234). The interface does not provide a way for users to adjust the query string; rather, this application uses query strings to present a limited set of options for the user to click on. But as we all know, anyone can generate any URI and query string with their client.

I would like to prevent people sending their own query strings in; I'd like to limit the query strings to the list of options that the protected server listed on the status page. Apache ProxyPass doesn't seem fit for the job; it won't work on query strings.

The right solution seems like a proxy that whitelists any URI (including query string) that the proxy scrapes out of the pages the server is sending back. This means only server-generated links, not user-generated links, are allowed through.

Is anyone aware of proxy software that can do that?

Is there another solution anyone can suggest that allows me to provide strictly limited access via a proxy to a backend server that uses query strings in its URIs?

Any help appreciated!

  • I'm assuming that you are unable to modify the source of this resource? Typically I'd try to get a limitation like this implemented at the application level. If the server is IIS (.asp url) you might be able to use Request Filtering – Nate May 9 '14 at 16:07
  • It's theoretically possible but difficult as I'm imposing a security device over server(s) owned by a development group, and it's not their priority to rewrite anything to make my life easy. I could mod_rewrite what's passing through so that the end clients are dealing with full URIs rather than URI+query strings, but then I've got to lock the proxy down to the static list of URIs that exist today (URIs can be rewritten as easily as query strings if the proxy is blindly rewriting them), and then if the backend app changes then security will break things. – gowenfawr May 9 '14 at 16:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.