Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For automatic updates to an application I maintain, I have the app access a particular URL on our website, but I noticed from some logs that some users get some HTML instead, that begins with:

<HTML><HEAD><META HTTP-EQUIV=\"Refresh\" CONTENT=\"0;URL=http://d14ii001:9017/authenticate?original_url=http%3A%2F%2Fdedicatedmicros

where dedicatedmicros is the start of the URL it checks for updates from.

Can anyone tell me what filter or proxy this looks like and ideally why dedicatedmicros.com might be filtered out.

The odd thing is that the request does seem to get through but the reply doesn't.

share|improve this question
    
So what are you deliversing as reply? Can you give an example? if it is binary data -here is the reason. –  TomTom Jan 22 '11 at 18:22
    

1 Answer 1

up vote 0 down vote accepted

It's almost impossible to say exactly what proxy would cause that, as a lot of them do it. I have a pair of BlueCoat ProxySG devices in my office that do exactly what you're seeing above, and have the same end behavior.

What's happening is the proxy is requiring the user be authenticated to use the service. The request by the client is being sent, and you see it in the logs, but the proxy intercepts the response, and sends a message to the client saying that it has to redirect to a different page. That page is where the client/end user is supposed to enter credentials to login. A lot of times, especially when setup as a transparent proxy configuration, this authentication ties in with some network authentication, like NTLM, Kerberos or the likes. With the proxy being considered a trusted host as it is in the private network, most browsers can auto-send login information.

Once authenticated, the proxy server will most likely send back some cookie, and allow access to the original URL. As you can see from the HTML code you have above, there is an argument being passed to the authentication script called "original_url". This is so the page knows where to send the client.

If this is device is not on your network, and managed by somebody else, you should try talking with the folks that manage the network there, and discuss the possibilities of a special bypass for your application, or site.

share|improve this answer
    
Thank you for that answer. I suppose I should try to log the IP address associated with the failure that this causes (the app uploads details of the failure too) and then work back to get an exception added for our application. –  Ricky Clarkson Jan 22 '11 at 22:02
    
Or could you get your application to support authentication? A lot of places will consider that reasonable - I know our general application support policy where I work is that if you expect us to change our network to fit your application instead of being able to configure the application to fit the network as it is, then we just assume the vendor simply doesn't want us to use their app... –  RobM Jan 22 '11 at 22:22
    
Is that authentication specced somewhere, or do I need to work it out for each network I want the application to work within? –  Ricky Clarkson Jan 23 '11 at 20:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.