Why can I not update the URL in the browser?

Why can I not update the URL in the browser?

I update QueryString and remove a malicious parameter. But, after executing the following code:

                filterContext.HttpContext.RewritePath(filterContext.HttpContext.Request.Path,
                                                       filterContext.HttpContext.Request.PathInfo,
                                                       filterContext.HttpContext.Request.QueryString.ToString());

Still see that bad domain.

I may be fighting development automation inside my own project;

I paste the following into the browser...

http://SENB-0186.mydomain.org/ContentManagement/?
goto=http%3a%2f%2fsenb-0186.mydomain.org.evil.com%3a80%2fContentManagement%2f

My code captures the goto parameter and removes it from the QueryString. I call the RewritePath() function above, and see the following in the browser


https://dev.nim.mydomain.org/IdentityServices//?return=http://senb-0186.mydomain.org
/ContentManagement/Account/LogOn?ReturnUrl=%2fContentManagement%2f%3fgoto%3dhttp%253a%252f%252f
senb-0186.mydomain.org.evil.com%253a80%252fContentManagement%252f&u
gid=040dec88-8a99-4410-bf72-1d868a207c8d

I have no problem with the introduction of https://dev.nim.mydomain.org/IdentityServices//?
but I do have a problem that the  mydomain.org.evil.com sub-domain re-appears.

Suggestions?

I even created a copy of QueryString, made the deletions on the sanitized version. But that also fails.

                filterContext.HttpContext.RewritePath(filterContext.HttpContext.Request.Path,
                                                       filterContext.HttpContext.Request.PathInfo,
                                                       sanitizedQueryString.ToString());

Thanks
newbiewebSr. Software EngineerAsked:
Who is Participating?
 
MrunalCommented:
Hi
It may be context (filterContext) are different on both the cases.

Have you tried routing of ASP.NET (available since .NET 3.5) ?

https://msdn.microsoft.com/en-us/library/cc668201(v=VS.90).aspx

Check other options here:

https://forums.asp.net/t/1336345.aspx?httpContext+RewritePath+not+working
0
 
newbiewebSr. Software EngineerAuthor Commented:
thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.