Hi,

I am developing a pay-per-view web based application. I am writing an
ISAPI filter that handles the security issues. When a user requests a
page with embedded media file located in a particular directory the
ISAPI checks whether the request came from a proper place by checking
cookies. If verified the file is passed through. Otherwise the user is
redirected to a signin page.

This works well for html and image files but not for the media files.
I noticed that when a request for a media file is processed the
cookies are not accessible. I reckon that this is due to the fact that
the request comes from the application (ie windows media player)
rather than browser and therefore the cookies are not passed.

Has anyone dealt with a similar situation? Is there a work around?
Would greatly appreciate your comments.

best regards

peter

Re: isapi filter cookie by David

David
Fri Nov 07 15:59:17 CST 2003

Cookies is primarily client-driven phenomenon over HTTP ( i.e. you're not
going to find cookies specified in the HTTP spec), so if you have a client
which does not support cookies... you're out of luck trying to use it.

Are you sure the problem is that the client does not support cookies, or is
the problem that your server is returning a cookie when the client knows it
never set a cookie (so it rejected it on security grounds)?

I think you're going to have to find another means of storing state --
perhaps you can keep a list of authenticated IP-addresses on the server and
redirect those that haven't logged in (i.e. transform the initial login
cookie into an IP stored on the server).

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"ptr" <ptr1024@yahoo.com> wrote in message
news:fb75c062.0311070956.5be88669@posting.google.com...
Hi,

I am developing a pay-per-view web based application. I am writing an
ISAPI filter that handles the security issues. When a user requests a
page with embedded media file located in a particular directory the
ISAPI checks whether the request came from a proper place by checking
cookies. If verified the file is passed through. Otherwise the user is
redirected to a signin page.

This works well for html and image files but not for the media files.
I noticed that when a request for a media file is processed the
cookies are not accessible. I reckon that this is due to the fact that
the request comes from the application (ie windows media player)
rather than browser and therefore the cookies are not passed.

Has anyone dealt with a similar situation? Is there a work around?
Would greatly appreciate your comments.

best regards

peter



Re: isapi filter cookie by Jerry

Jerry
Fri Nov 07 18:04:54 CST 2003

Just use simple url rewriting - embed the value of the cookie in the url
used by media player and strip it out in your filter in preproc headers or
redirect the client to the login page or even better, send an access denied
error to the client (as media player probably won't be able to display the
login page).

Jerry

"ptr" <ptr1024@yahoo.com> wrote in message
news:fb75c062.0311070956.5be88669@posting.google.com...
> Hi,
>
> I am developing a pay-per-view web based application. I am writing an
> ISAPI filter that handles the security issues. When a user requests a
> page with embedded media file located in a particular directory the
> ISAPI checks whether the request came from a proper place by checking
> cookies. If verified the file is passed through. Otherwise the user is
> redirected to a signin page.
>
> This works well for html and image files but not for the media files.
> I noticed that when a request for a media file is processed the
> cookies are not accessible. I reckon that this is due to the fact that
> the request comes from the application (ie windows media player)
> rather than browser and therefore the cookies are not passed.
>
> Has anyone dealt with a similar situation? Is there a work around?
> Would greatly appreciate your comments.
>
> best regards
>
> peter



Re: isapi filter cookie by ptr1024

ptr1024
Mon Nov 10 04:17:56 CST 2003

Thanks Jerry. that's what I thought...

peter


"Jerry III" <jerryiii@hotmail.com> wrote in message news:<ejekwvYpDHA.2808@TK2MSFTNGP10.phx.gbl>...
> Just use simple url rewriting - embed the value of the cookie in the url
> used by media player and strip it out in your filter in preproc headers or
> redirect the client to the login page or even better, send an access denied
> error to the client (as media player probably won't be able to display the
> login page).
>
> Jerry
>
> "ptr" <ptr1024@yahoo.com> wrote in message
> news:fb75c062.0311070956.5be88669@posting.google.com...
> > Hi,
> >
> > I am developing a pay-per-view web based application. I am writing an
> > ISAPI filter that handles the security issues. When a user requests a
> > page with embedded media file located in a particular directory the
> > ISAPI checks whether the request came from a proper place by checking
> > cookies. If verified the file is passed through. Otherwise the user is
> > redirected to a signin page.
> >
> > This works well for html and image files but not for the media files.
> > I noticed that when a request for a media file is processed the
> > cookies are not accessible. I reckon that this is due to the fact that
> > the request comes from the application (ie windows media player)
> > rather than browser and therefore the cookies are not passed.
> >
> > Has anyone dealt with a similar situation? Is there a work around?
> > Would greatly appreciate your comments.
> >
> > best regards
> >
> > peter

Re: isapi filter cookie by ptr1024

ptr1024
Mon Nov 17 07:05:07 CST 2003

I have yet another problem with the filter and the media files which i
cannot figure out...

A media file is <EMBEDed into an html page. Bellow is a simple snippet
of OnPreprocHeaders code.

This is what happens:

* when I just pass the url to the media file through the filter AND
the url does not contain a query string after the file name (eg
/test.wma) it works fine with either 7 or 9 versions of WMP
* when I pass the url through the filter BUT the url contains query
string (eg /test.wma?v=12345) it fails when accessed via WMP7 (i am
getting 'The page cannot be displayed') but works when accessed from a
machine with WMP9 installed
* when I GetHeader("url") and then SetHeader("url") on
OnPreprocHeaders without modifying the url I can access it from WMP9
but not WMP7 (regardless whether a query string is present or not).
* this problem does not relate to html, gif, jpeg files

Is there some extra information that have to be passed in the header
for older WMPs? I tried to add
pCtxt->m_pFC->AddResponseHeaders(pCtxt->m_pFC, "Content-type =
application/x-mplayer2\r\n\r\n", 0); in OnPreprocHeaders but still the
same problem.

I would greatly appreciate any help or suggestions

many thanks

peter

PS using the code bellow I can access media files using WMP9 but not
WMP7



DWORD COvumFltrFilter::OnPreprocHeaders(CHttpFilterContext* pCtxt,
PHTTP_FILTER_PREPROC_HEADERS pHeaderInfo)
{
char pUrl[1024];
LPDWORD pBufLen = new DWORD;
char* pTmp = 0;

*pBufLen = (DWORD)1024;

for(int i=0; i<1024; i++)
pUrl[i] = 0;

pHeaderInfo->GetHeader(pCtxt->m_pFC, "url", pUrl, pBufLen);

if(strstr(pUrl, ".wma")){
if(pTmp=strstr(pUrl, "?"))
*pTmp = '\0';

pHeaderInfo->SetHeader(pCtxt->m_pFC, "url", pUrl);
}


delete pBufLen;

return SF_STATUS_REQ_NEXT_NOTIFICATION;
}





ptr1024@yahoo.com (ptr) wrote in message news:<fb75c062.0311100217.425c22f0@posting.google.com>...
> Thanks Jerry. that's what I thought...
>
> peter
>
>
> "Jerry III" <jerryiii@hotmail.com> wrote in message news:<ejekwvYpDHA.2808@TK2MSFTNGP10.phx.gbl>...
> > Just use simple url rewriting - embed the value of the cookie in the url
> > used by media player and strip it out in your filter in preproc headers or
> > redirect the client to the login page or even better, send an access denied
> > error to the client (as media player probably won't be able to display the
> > login page).
> >
> > Jerry
> >
> > "ptr" <ptr1024@yahoo.com> wrote in message
> > news:fb75c062.0311070956.5be88669@posting.google.com...
> > > Hi,
> > >
> > > I am developing a pay-per-view web based application. I am writing an
> > > ISAPI filter that handles the security issues. When a user requests a
> > > page with embedded media file located in a particular directory the
> > > ISAPI checks whether the request came from a proper place by checking
> > > cookies. If verified the file is passed through. Otherwise the user is
> > > redirected to a signin page.
> > >
> > > This works well for html and image files but not for the media files.
> > > I noticed that when a request for a media file is processed the
> > > cookies are not accessible. I reckon that this is due to the fact that
> > > the request comes from the application (ie windows media player)
> > > rather than browser and therefore the cookies are not passed.
> > >
> > > Has anyone dealt with a similar situation? Is there a work around?
> > > Would greatly appreciate your comments.
> > >
> > > best regards
> > >
> > > peter

Re: isapi filter cookie by ptr1024

ptr1024
Tue Nov 18 03:43:14 CST 2003

Hi David,

thanks very much for your replay.

I use a query string to pass some information to the server in order
to do verification in OnPreprocHeaders. Once it is done I strip the
query string (in OnPreprocHeaders) and send a plain .wma file back to
the client. However once i rewrite the url (using the code I sent
earlier) the file is not received by the client if the client is using
wmp7. It works perfectly for clients with wmp9 though. I tried it on
the same machine first with wmp7 and then upgraded to wmp9.

it sounds very strange and the only thing I can think of is that
whenever the url is set using SetHeader() (even if it is exactly the
same url as before) something else gets reset in the header

thanks

peter

ps thanks for pointing out re AddResponseHeaders



"David Wang [Msft]" <someone@online.microsoft.com> wrote in message news:<ekBbjtXrDHA.2476@tk2msftngp13.phx.gbl>...
> I have no idea the requirements for Windows Media. It sounds like you are
> trying to use querystring to pass special info around, so I advise that you
> implement it such that Windows Media isn't aware of the existence of the
> querystring.
>
> Your AddResponseHeaders code is wrong (do not send two sets of \r\n), and it
> should be completely unnecessary since if you have .wma MIMEMapped correctly
> on the server, IIS will send it for you as a static file.
>
> --
> //David
> IIS
> This posting is provided "AS IS" with no warranties, and confers no rights.
> //
> "ptr" <ptr1024@yahoo.com> wrote in message
> news:fb75c062.0311170505.31119837@posting.google.com...
> I have yet another problem with the filter and the media files which i
> cannot figure out...
>
> A media file is <EMBEDed into an html page. Bellow is a simple snippet
> of OnPreprocHeaders code.
>
> This is what happens:
>
> * when I just pass the url to the media file through the filter AND
> the url does not contain a query string after the file name (eg
> /test.wma) it works fine with either 7 or 9 versions of WMP
> * when I pass the url through the filter BUT the url contains query
> string (eg /test.wma?v=12345) it fails when accessed via WMP7 (i am
> getting 'The page cannot be displayed') but works when accessed from a
> machine with WMP9 installed
> * when I GetHeader("url") and then SetHeader("url") on
> OnPreprocHeaders without modifying the url I can access it from WMP9
> but not WMP7 (regardless whether a query string is present or not).
> * this problem does not relate to html, gif, jpeg files
>
> Is there some extra information that have to be passed in the header
> for older WMPs? I tried to add
> pCtxt->m_pFC->AddResponseHeaders(pCtxt->m_pFC, "Content-type =
> application/x-mplayer2\r\n\r\n", 0); in OnPreprocHeaders but still the
> same problem.
>
> I would greatly appreciate any help or suggestions
>
> many thanks
>
> peter
>
> PS using the code bellow I can access media files using WMP9 but not
> WMP7
>
>
>
> DWORD COvumFltrFilter::OnPreprocHeaders(CHttpFilterContext* pCtxt,
> PHTTP_FILTER_PREPROC_HEADERS pHeaderInfo)
> {
> char pUrl[1024];
> LPDWORD pBufLen = new DWORD;
> char* pTmp = 0;
>
> *pBufLen = (DWORD)1024;
>
> for(int i=0; i<1024; i++)
> pUrl[i] = 0;
>
> pHeaderInfo->GetHeader(pCtxt->m_pFC, "url", pUrl, pBufLen);
>
> if(strstr(pUrl, ".wma")){
> if(pTmp=strstr(pUrl, "?"))
> *pTmp = '\0';
>
> pHeaderInfo->SetHeader(pCtxt->m_pFC, "url", pUrl);
> }
>
>
> delete pBufLen;
>
> return SF_STATUS_REQ_NEXT_NOTIFICATION;
> }
>
>
>
>
>
> ptr1024@yahoo.com (ptr) wrote in message
> news:<fb75c062.0311100217.425c22f0@posting.google.com>...
> > Thanks Jerry. that's what I thought...
> >
> > peter
> >
> >
> > "Jerry III" <jerryiii@hotmail.com> wrote in message
> news:<ejekwvYpDHA.2808@TK2MSFTNGP10.phx.gbl>...
> > > Just use simple url rewriting - embed the value of the cookie in the url
> > > used by media player and strip it out in your filter in preproc headers
> or
> > > redirect the client to the login page or even better, send an access
> denied
> > > error to the client (as media player probably won't be able to display
> the
> > > login page).
> > >
> > > Jerry
> > >
> > > "ptr" <ptr1024@yahoo.com> wrote in message
> > > news:fb75c062.0311070956.5be88669@posting.google.com...
> > > > Hi,
> > > >
> > > > I am developing a pay-per-view web based application. I am writing an
> > > > ISAPI filter that handles the security issues. When a user requests a
> > > > page with embedded media file located in a particular directory the
> > > > ISAPI checks whether the request came from a proper place by checking
> > > > cookies. If verified the file is passed through. Otherwise the user is
> > > > redirected to a signin page.
> > > >
> > > > This works well for html and image files but not for the media files.
> > > > I noticed that when a request for a media file is processed the
> > > > cookies are not accessible. I reckon that this is due to the fact that
> > > > the request comes from the application (ie windows media player)
> > > > rather than browser and therefore the cookies are not passed.
> > > >
> > > > Has anyone dealt with a similar situation? Is there a work around?
> > > > Would greatly appreciate your comments.
> > > >
> > > > best regards
> > > >
> > > > peter