Forum OpenACS Q&A: When using the revproxy module, how to rewrite the form

I am setting up the reverse proxy module so I can send a request to another server. I understand and have working the filter and rewrite_url call to add an element and value to the query string of a GET request.

I would like to be able to do this with a POST and a PUT. Is there a way to write to the form/body of the request that gets forwarded?

Thanks,
-Tony Kirkham

Thank you very much for your quick response and the detail. I have a similar set up in my config.tcl and the redirection works great.

What I am trying to accomplish is to authenticate using a main NaviServer instance, get the authenticated users person_id and inject that person_id into the original request as it is redirected to another server. In the ns_register_filter call I am using the -url_rewrite_callback switch to include the person_id. Here is my register call

ns_register_filter postauth GET "/pmd/*" ::revproxy::upstream -target "https://another.server.edu" -url_rewrite_callback pmd::rewrite_url

With my rewritten callback looking like the following

nsf::proc pmd::rewrite_url {
    -target -url {-query ""}
} {
    set query "user_id=[ad_conn user_id][expr {$query eq "" ? "" : "&"}]$query"
    append url ?$query
    return $url
}

This works great for a GET request. What I want is to do the same for a POST and PUT request. Since they are not GET requests I do not want to use the query string. I want to push the "user_id=1234" into the body / form of the request that is sent on to the other server.

Is there a way to accomplish this?

Thanks again,

-Tony

The experience I have had with AOLServer was exactly what I was concerned about. After doing some other testing it appears that passing the authenticated user_id in the query string is working just fine for a POST. I have set up the ns_register_filter postauth with a * in the place of the method and it is working for both POST and GET. I am expecting it to work for all methods.

GET and POST requests are working well, but we have encountered a problem with a PUT request.

In the callback proc I am obtaining the user_id, to send onto the other server, via a call to [auth::require_login]. This is not working in the case of PUT. With a PUT request the user_id is not obtained inside of the [auth::require_login] via the call to [auth::get_user_id ...]. It returns 0 even though a successful GET or POST was just performed so I know I am logged in. (A subsequent POST after the failed PUT works fine as well.) The cookies are all sent the same as well.

Inside the [auth::require_login] after [auth::get_user_id ...] returns 0, a call to [ad_conn auth_level] is made and fails with an error stating that "auth_level" is not a valid option. This is true. I cannot find "auth_level" as a valid option in ad_conn nor in ns_conn so I do not understand how this call ever succeeds, even though I can call [ad_conn auth_level] from the shell and it returns "ok". This is baffling to me.

With all of this said, is there something different about the PUT method that is different from a GET and POST that would cause the request processor to not authenticate the user (as well as cause auth::require_login to fail)? Is there a way to overcome this?

Thanks,
-Tony

That worked! Thanks!

Here is what I did. In my package tcl directory I have a revproxy-init.tcl file with the filter registrations, rather than changing the request-processor-init.tcl file.

# pulled from acs-tcl/tcl/request-processor-init.tcl
    foreach httpMethod {PUT} {
        ns_register_filter preauth $httpMethod /resources/* rp_resources_filter
        ns_register_filter preauth $httpMethod * rp_filter
        ns_register_proc $httpMethod / rp_handler
    }
# the postauth filter registration is here

Do I need all three of those registrations? Also, in the request-processor-init.tcl the above filter registration calls are surrounded by a check and comment about making sure that they only run once.

if {[nsv_exists rp_properties request_count] == 0} {
    #
    # Run this only once at startup, and not on re-inits
    #
    nsv_set rp_properties request_count 0

    foreach httpMethod {GET HEAD POST} {
        ns_register_filter preauth $httpMethod /resources/* rp_resources_filter
        ns_register_filter preauth $httpMethod * rp_filter
        ns_register_proc $httpMethod / rp_handler
    }
}

I tried to put this same check around my register calls, but it failed the check and never entered to execute that code so my filters did not get registered. By the time the system is loading my package init file the request_count has incremented to 1. Do I need to worry about that? I do not know when "re-inits" occur. I can only assume that if the one filter registration is concerned about it I should also worry about it.