HTTP 401 Error Only When Using IIS ARR Proxy

Question

A application which contains a web interface is running on a Windows Server 2019 system with IIS 10 and ARR installed. When navigating to the webpage using IP:Port the webpage loads correctly. When navigating to the webpage using domain.com the website has some content that shows a 401 error in the console, and page does not load correctly.

When navigating to the domain the request passes through IIS and URL Rewrite. It would seem that there is some issue in regards to passing the information through the proxy.

This is the code for the rewrite rule in IIS:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="ReverseProxyInboundRule1" stopProcessing="true">
                    <match url="(.*)" />
                    <action type="Rewrite" url="http://localhost:33337/{R:1}" />
                <serverVariables>
                        <set name="HTTP_ACCEPT_ENCODING" value="" />
                </serverVariables>
                </rule>
            </rules>
            <outboundRules>
                <rule name="ReverseProxyOutboundRule1" preCondition="ResponseIsHtml1">
                    <match filterByTags="A, Form, Img" pattern="^http(s)?://localhost:33337\/?(.*)" />
                    <action type="Rewrite" value="http{R:1}://sub.domain.com/{R:2}" />
                </rule>
                <preConditions>
                    <preCondition name="ResponseIsHtml1">
                        <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
                    </preCondition>
                </preConditions>
            </outboundRules>
        </rewrite>
        <urlCompression doStaticCompression="false" doDynamicCompression="true" dynamicCompressionBeforeCache="false" />
    </system.webServer>
</configuration>

This is the GitHub Issue link for this specific issue: https://github.com/qbittorrent/qBittorrent/issues/11207

Answer 1

I reproduced the issue.

Apparently qBittorrent expecting clients to send same-origin Referer headers. In your case it must be localhost:33337 but obviously sub.domain.com is being sent.

This security measure is activated by Enable Cross-Site Request Forgery (CSRF) protection setting that can be reached via qBitorrent > Options > Web UI > Security.

You have two options for the solution.

• Disable the setting.
• Rewrite the Referer header with an appropriate value.

If you want to rewrite the header, after allowing server variables HTTP_REFERER and HTTP_ORIGIN as you did for HTTP_ACCEPT_ENCODING, you should change your rules as follows.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="ReverseProxyInboundRule1" stopProcessing="true">
                    <match url="(.*)" />
                    <action type="Rewrite" url="http://localhost:33337/{R:1}" />                    

                    <!-- New Optional Condition -->
                    <conditions logicalGrouping="MatchAny">
                        <add input="{HTTP_REFERER}" pattern="^(?:https?://[^/]*/(.*))?$" />
                    </conditions>

                    <serverVariables>
                        <set name="HTTP_ACCEPT_ENCODING" value="" />

                        <!-- New Header Rewrite -->
                        <set name="HTTP_REFERER" value="http://localhost:33337/{C:1}" />

                        <!-- Remove Origin Header -->
                        <set name="HTTP_ORIGIN" value="" />
                    </serverVariables>
                </rule>
            </rules>
            <outboundRules>
                <rule name="ReverseProxyOutboundRule1" preCondition="ResponseIsHtml1">
                    <match filterByTags="A, Form, Img" pattern="^http(s)?://localhost:33337\/?(.*)" />
                    <action type="Rewrite" value="http{R:1}://sub.domain.com/{R:2}" />
                </rule>
                <preConditions>
                    <preCondition name="ResponseIsHtml1">
                        <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
                    </preCondition>
                </preConditions>
            </outboundRules>
        </rewrite>
        <urlCompression doStaticCompression="false" doDynamicCompression="true" dynamicCompressionBeforeCache="false" />
    </system.webServer>
</configuration>

BTW bear in mind that, qBittorrent warns you about the issue. Remember to check Execution Log tab.