Why IIS rewrite rule returns error when set server variable?

Question

I added a new application to IIS and added a web.config file to rewrite:

https://mylocaldomain.com/ogc?a=2&b=3&c=3...

to

https://myactualdomain.com/ogc?a=2&b=3&c=3...

But http://myactualdomain.com requires Basic authentication requests.

So that my Web.config is like following:

<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="wms" stopProcessing="true">
                    <match url="^ogc?(.*)" />
                    <action type="Rewrite" url="http://myactualdomain.com/ogc?(.*)" />
                    <serverVariables>                           
                        <set name="HTTP_Authorization" value="Basic abcdefgasdas" />
                    </serverVariables>
                </rule>
            </rules>
          <outboundRules>
              <clear />
              <rule name="wms">
                  <match serverVariable="RESPONSE_Access_Control_Allow_Origin" pattern=".*" />
                  <conditions logicalGrouping="MatchAll" trackAllCaptures="true">
                      <add input="{HTTP_ORIGIN}" pattern="(.*)" />
                  </conditions>
                  <action type="Rewrite" value="{C:0}" />
              </rule>
          </outboundRules>
        </rewrite>
    </system.webServer>
</configuration>

This settigns returns error:

500 - Internal server error.
There is a problem with the resource you are looking for, and it cannot be displayed.

If I remove following lines, there is no error but a username and password popup appearing.

 <serverVariables>                          
      <set name="HTTP_Authorization" value="Basic abcdefgasdas" />
 </serverVariables>

If I set any kind of serverVariables, 500 error occured. How can I solve this issue?

Answer 1

By default, the distributed rewrite rules (i.e. the rules that are defined for specific sites or web applications) cannot set or change any IIS server variable, unless the server variable is added to the "Allowed" list.

Select the "View Server Variables..." action from the "Actions" pane:

Use the "Add..." action to add the server variables HTTP_COOKIE and ORIGINAL_URI to the "Allowed Server Variables" list:

If the problem still exists, please use FRT to see the cause of this 500 error.