I'm setting up a reverse proxy to limit access to a protected resource. The protected resource provides a status page (http://protected.local/info). That page contains a number of links with query strings in order to drill down (http://protected.local/info/detail.asp?zip=01234). The interface does not provide a way for users to adjust the query string; rather, this application uses query strings to present a limited set of options for the user to click on. But as we all know, anyone can generate any URI and query string with their client.
I would like to prevent people sending their own query strings in; I'd like to limit the query strings to the list of options that the protected server listed on the status page. Apache ProxyPass doesn't seem fit for the job; it won't work on query strings.
The right solution seems like a proxy that whitelists any URI (including query string) that the proxy scrapes out of the pages the server is sending back. This means only server-generated links, not user-generated links, are allowed through.
Is anyone aware of proxy software that can do that?
Is there another solution anyone can suggest that allows me to provide strictly limited access via a proxy to a backend server that uses query strings in its URIs?
Any help appreciated!