title: ASP.NET OAuth having issues with URL Rewrite
body: <p>My production setup is as follows: </p>
  
  <ul>
  <li>M1 – ASP.NET Website  </li>
  <li>M2 - IIS URL Rewrite 2.0 + ARR 3.0</li>
  </ul>
  
  <p>Using IIS URL Rewrite, any request to M2, say <em>http://<strong>m2</strong>/app/login.aspx</em> will be redirected to M1 as <em>http://<strong>m1</strong>/app/login.aspx</em>.</p>
  
  <p>On M1, ASP.NET Open Auth has been implemented on the website to use Google external authentication. When user clicks the Google button, the browser will be redirected to the Google login page to allow the user to authenticate.</p>
  
  <p>But when the website is accessed from M2, the redirection url generated by .net oAuth(<em>https://<strong>accounts.google.com</strong>/[query-string]</em>) to redirect to Google, is being replaced by URL Rewrite as <em>http://<strong>m2</strong>/[query-string]</em>.</p>
  
  <p>So just to be clear; when the request is made to authenticate via an external authentication provider a <strong>302 redirect</strong> is returned. Often the form of this may look like:</p>
  
  <p><strong>Response Headers:</strong></p>
  
  <p>...</p>
  
  <p>Location: https://<strong>accounts.google.com</strong>/o/oauth2/auth?big_long_query_string</p>
  
  <p>...</p>
  
  <p>This redirect is created by a server (M1) that sits behind the proxy server (M2 - IIS URL Rewrite 2.0 + ARR 3.0). So the rewrite server rewrites the Location header to:</p>
  
  <p><strong>Response Headers:</strong></p>
  
  <p>...</p>
  
  <p>Location: http://<strong>M1</strong>/o/oauth2/auth?big_long_query_string</p>
  
  <p>...</p>
  
  <p>What we need is a rule that does not rewrite the location URL on redirection. It can only target certain redirects as well. Most of the time the behaviour mentioned here is wanted as all redirects are redirected to the main proxy server. Can someone suggest a solution or workaround for certain redirects?</p>