Redirect Response always redirects to the same domain

Question

I'm writing a suite of ASP.NET Core web applications that occasionally have to redirect to one another. When testing locally, everything works fine. However, when I publish them on our staging server, the redirects always "stay" in the same host. For example, if I am on http://app1.test/ and redirect to http://app2.test/somepath, what I actually get in the Location HTTP header i http://app1.test/somepath: any URL I specify is transformed so that it "stays" in the current host name.

This doesn't happen locally, however. I've deployed the apps as Kestrel processes, and they are exposed via IIS working as a reverse proxy. May this be the cause? What should I do to fix the issue?

UPDATE

Here is the full web.config for the reverse proxy of app1.test:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="ReverseProxyInboundRule1" stopProcessing="true">
                    <match url="(.*)" />
                    <action type="Rewrite" url="http://localhost:5000/{R:1}" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
    <system.web>
        <sessionState mode="InProc" />
        <customErrors mode="RemoteOnly" />
    </system.web>
</configuration>

app2.test's web.config is virtually the same (apart, of course, for the port numbers).

UPDATE 2

I'll try to explain better. I noticed that the target site doesn't really matter, so I'll keep things simpler: I have an action in my application that I want to redirect the user to Google. This is the action, in the Home controller:

public IActionResult ToGoogle()
{
    return Redirect("https://www.google.com?q=Hi");
}

If I launch the web app locally and request http://localhost:1234/Home/ToGoogle, everything is fine: the response is a 302 Found, with the correct URL (www.google.com etc.) in the Location header.

Once I publish the app to the staging server (Kestrel app on port 5000, behind an IIS reverse proxy with the rewrite rule posted above), this is what happens instead:

What is the cause of that?

Sounds like it is the reverse proxy. Do you have any rules in your config files? You can read more about it [here](https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/reverse-proxy-with-url-rewrite-v2-and-application-request-routing) — Aman B, Dec 17 '18 at 10:51
@AmanB I thought so, but I'm not sure what I'm doing wrong. I posted the web.config of my app. — Simone, Dec 17 '18 at 11:23
@AmanB No, that's not what I want. There's no point in even letting know visitors that the internal, proxied server is `localhost:5000`. Instead I need to redirect it to _another_ site. — Simone, Dec 17 '18 at 11:34

score 1 · Accepted Answer · answered Dec 17 '18 at 16:26

I found the solution myself. It was indeed a problem with reverse proxy.

IIS has an option to rewrite the host in response headers. The solution is described in this answer (there are addenda in other answers to that same question if your version of IIS or Windows Server is not the one specified).

Redirect Response always redirects to the same domain

1 Answers1