Sending visitors to consent page with IIS URL Rewrite module

Question

I am working with a MVC app in which I am trying to implement a process where the user gets redirected to a consent page ( http://www.company.com/AppOne/landingpage.html ). They will have to agree to the consent by clicking on an 'Accept' button before being taken to their destination page ( http://www.company.com/AppTwo/subsite ).

I have added the following lines to the web.config file in the 'AppTwo' directory:

<rewrite>
    <rules>
        <rule name="PreventRandomHit" stopProcessing="true">
             <match url=".*" />
             <conditions>
                 <add input="{HTTP_REFERER}" pattern="^http://company.com/AppOne/.*$" negate="true" />
             </conditions>
             <action type="AbortRequest" />
        </rule>
   </rules>
</rewrite>

The problem I am getting is that when I click on the "Accept" button, it takes me back to the consent page rather to the destination page. This is my first time using the IIS URL Rewrite module. I am also following this link as an example, https://www.tachyondynamics.com/windows-iis-server-dod-login-banner/ . Thanks in advance!

Answer 1

URL Rewrites are a poor fit for this problem. You should use an actual action, where you can apply real logic about whether a user should be redirected or not. Namely, you need to somehow persist the fact that they have "consented". That could be via the session, a cookie, or directly notating it on their user record. In any case, you should then check for that when deciding whether or not to redirect and only issue the redirect if the necessary consent indicator is not set.