Subject: Fun w/ Proxies-Firewalls

From: "Kevin Wiggen" <[email-masked]>
Date: Fri, 20 Aug 1999 17:55:54 -0700

Just thought I would report to everyone what I found today on Firewalls and
Proxies.  If anyone has any data in this area, please tell me...

Web Folders.

1)  Run with no proxies set at a non-SSL port.  - Works fine
2)  Run with a proxy server at a non-SSL port - FAILS
3)  Run with no proxies set at a SSL port - Works fine
4)  Run with a proxy server at a SSL port - Works fine

It seems that the code line which does proxies without SSL is missing the
Webdav code.

IE or Office will simply send the GET and POST with the /_vti stuff.  It
never even tries to do an options.  This all occurs when the Tools ->
Internet Options -> Connections -> LAN settings -> Use a proxy server
checkbox is clicked.

Does anyone have a workaround for this without forcing the use of SSL?  Is
this consistent with what other people are finding?

Thanks,
Kevin

---

From: Joe Orton <[email-masked]>
Date: Sat, 21 Aug 1999 10:02:40 +0100 (BST)

> Internet Options -> Connections -> LAN settings -> Use a proxy server

We found some (HTTP/1.0) proxies don't let through 'extension' methods
like OPTIONS, let alone MKCOL, DELETE etc. Maybe IE is trying an OPTIONS
and the proxy blocks it from getting to the server, so it falls back on
GET/POST?

joe

-- 
Joe Orton
[email-masked] ... [email-masked]
http://www.orton.demon.co.uk/

---

From: "Kevin Wiggen" <[email-masked]>
Date: Sat, 21 Aug 1999 09:32:46 -0700

This is a good point.  I was working with Raptor v5 & v6 for HTTP proxy
services, a Squid?? (that one is a friend of mine) proxy, and the
JavaWebserver Proxy.

We were looking at the Logs of the Proxies as we went.  When the checkbox
for "use proxy" is set in IE, it simply never sends the OPTIONS request....

On that same note, if your client mistakenly sends an OPTIONS with a
HTTP/1.0 Header, most Firewalls I looked at will block it.  So be careful.
(I noticed that the GET /_vti stuff still sends HTTP/1.0 headers.  I thought
this might be the problem, but by viewing the logs it was not)  In viewing
the Sharemation logs, there are some OPTIONS requests with the 1.0 Header.
The following is out of the Raptor FAQ:

<RAPTOR>
219 Can't parse URL:  (OPTIONS * HTTP/1.0 ......
The browser requested the use of the OPTIONS methods, but OPTIONS is not
part of the HTTP/1.0 standard.  It is part of HTTP/1.1.  The browser may be
allowed to ask for it, but it should specify HTTP/1.1 in the request header.
The Raptor Firewall acts correctly in refusing to support it.
</RAPTOR>

Kevin