Is there any way to filter certain things in pages served by IIS?

Question

Hello,

This is my first time posting here so please keep that in mind...

I'll try to be short and get right to defining the problem. We have an ASP.NET 2 application (eCommerce package) running on IIS (Windows Server 2003). The main site's page(s) are using plain HTTP (no SSL), but the whole checkout process and the shopping cart page is using SSL (HTTPS). Now, the problem is that the site's header is located in a template file, and inside it it has a plain HTML 'img' tag calling an image with the "http://" portion hard-coded into it... This header appears on absolutely every page (including the https pages), and due to its insecure image tag, a warning box pops up in IE on every stage of the checkout process...

Now, the problem: The live application cannot be touched in any way (no changes can be made to the template (so simply changing "http://" to "//" is not an option), IIS cannot be restarted, and the website/app pool cannot be restarted). Is there any way in the world (maybe plugin for IIS or a setting somewhere) that I can filter the pages right before they are served to replace the '<img src="http://example.com/image.jpg"&gt;' with '<img src="//example.com/image.jpg">' in the final HTML? Possibly via a regular expression or something?

Thanks to everybody in advance.

Answer 1

Just a guess but you can add a footer in IIS and try to do something with JavaScript or jQuery or something in the footer ...

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/e27f918e-89a9-45a8-8604-2ad2ded09d64.mspx?mfr=true

Problem is I'm pretty sure at that point you'd have already made the request to download the offending image.

You might be able to disable the image's display in your CSS, then use jQuery (for example) to replace the img tag that matches http:// with one that has https:// or /image.jpg or something.

See: api.jquery.com/find/

To outright replace the HTML before it gets progessed by the browser you'd need a HTTP Handler (.NET) ... which seems like crazy overkill here.

I'm a little confused how you can make all these modifications to the ISS, or edit the contents of the template on load, but you can't just go and edit the template! :)

Answer 2

If you had an F5 BigIP (http://www.f5.com/products/big-ip/) in front of your web farm you could rewrite requests and responses quite easily to fix the problem. But it wouldn't be cheap!