Kudu: Multiple allowedServerVariables seem to not be set via applicationHost.xdt

[robmen]

I'm attempting to configure an Azure Website as a reverse proxy. To preserve Accept-Encoding, it is necessary to store the header's value before executing the proxy call without Accept-Encoding (because outbound rules can't process compressed data). That's a lot of possibly unnecessary detail that gets to the point.

To allow the rewrite rule to store and change Accept-Encoding, two variables must be added to the allowedServerVariables in the applicationHost.config. I've done that using a applicationHost.xdt like so:

<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
<system.webServer>
    <proxy xdt:Transform="InsertIfMissing" enabled="true" preserveHostHeader="false" reverseRewriteHostInResponseHeaders="false" />

    <rewrite>
    <allowedServerVariables>
        <add name="HTTP_ACCEPT_ENCODING" xdt:Transform="InsertIfMissing" />
        <add name="X_ORIGINAL_ACCEPT_ENCODING" xdt:Transform="InsertIfMissing" />
    </allowedServerVariables>
    </rewrite>
</system.webServer>
</configuration>

The problem is that it seems only the _first_ server variable is added to the list. Whichever I put first of HTTP_ACCEPT_ENCODING or X_ORIGINAL_ACCEPT_ENCODING does seem to be set and the use of the second one will cause a failure.

Am I doing something wrong? Is this supposed to work? If so, which way should I go? Thanks.

[davidebbo]

Do you mean that the resulting applicationhost.config does not have what you expect, or that it has what you expect but does not work as you expect? Please see https://github.com/projectkudu/kudu/wiki/Azure-Site-Extensions#understanding-what-could-go-wrong-with-xdt-transforms.

[robmen]

I was trying to figure out how to view the applicationHost.config, thanks for that link!

Now that I can see the file, I can see that it does not have what I expect. The above .xdt I provided ends up adding only a single variable.

<rewrite>
  <allowedServerVariables>
    <add name="HTTP_ACCEPT_ENCODING" />
  </allowedServerVariables>

The second add <add name="X_ORIGINAL_ACCEPT_ENCODING" xdt:Transform="InsertIfMissing" /> does not seem to be applying.

[robmen]

Sorry, I see the problem now. I'm InsertIfMissing the add element but it needs take into account the name attribute. Sorry, beginner mistake.

The link to finding the resulting applicationHost.config helped me finally see the mistake. Thanks.

PS: It might be interesting to link to the page you provided from this wiki page: https://github.com/projectkudu/kudu/wiki/Xdt-transform-samples. Very helpful debugging.

[davidebbo]

I'll give you a better way. I just added a section in https://github.com/projectkudu/kudu/wiki/Azure-Site-Extensions#authoring-xdt-transforms about using a site extension that makes it super easy to write correct xdt's. I know you figured it out, but can you give that a try to see if it finds something more optimal for your transform? I'm interested in the feedback on the usability of this new extension by @shibayan. It has worked great for me every time I've tried it :)

[brianchance]

@robmen - I am running into the same issue, what did you end up doing? With this...

    <rewrite>
            <allowedServerVariables>
                <add name="HTTP_ACCEPT_ENCODING" xdt:Transform="InsertIfMissing" />
                <add name="HTTP_X_ORIGINAL_HOST" xdt:Transform="InsertIfMissing" />
            </allowedServerVariables>
        </rewrite

I only get the first one (CONTENT_TYPE) in the resulting applicationHost.config. Changing the order changes the one I get.

@davidebbo - this is the same as the example page, which only shows one entry. https://github.com/projectkudu/kudu/wiki/Xdt-transform-samples#add-an-allowedservervariables

[robmen]

@brianchance, my issue was resolved. Although it's been a long time since I worked with this issue.

[brianchance]

@robmen - do you have a snippet of how you resolved it?

[robmen]

@brianchance I do not.

[brianchance]

For all those arriving here looking for a solution, the example needs xdt:Locator="Match(name)"

<rewrite>
    <allowedServerVariables>
        <add name="HTTP_ACCEPT_ENCODING" xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" />
        <add name="HTTP_X_ORIGINAL_HOST" xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" />
    </allowedServerVariables>
</rewrite>

I would also point out that using Insert works with no locator, this could cause issues with duplicates, but when using Azure Web Apps, the applicationHost.base.config has

<rewrite>
    <allowedServerVariables>
        <add name="HTTP_ACCEPT_ENCODING" xdt:Transform="Insert" />
        <add name="HTTP_X_ORIGINAL_HOST" xdt:Transform="Insert" />
    </allowedServerVariables>
</rewrite>

[mcliment]

Thanks @brianchance for the tip. Actually if you don't use match only one rule is added because the InsertIfMissing is matching over the add element and not over the name property.

Then, @davidebbo, I think that the example here https://github.com/projectkudu/kudu/wiki/Xdt-transform-samples#add-an-allowedservervariables is a bit misleading because uses InsertIfMatch but won't work if you already have one. It may be obvious if you have experience with XDT transformations but I don't think it's the case in most cases. Adding xdt:Locator="Match(name)" won't hurt and will work on most situations. Should I open a ticket?

[davidebbo]

@mcliment I don't see an InsertIfMatch in that sample. Can you include what you think is the complete correct xdt for that scenario?

[mcliment]

@davidebbo Sorry, I meant InsertIfMissing. If I understand correctly, if you add another add element to the sample or there's already and add element in the allowedServerVariables section, it won't do anything. You should add a Locator match by the name property and not by the add element.

[Jehoel]

Thank you @brianchance! You saved me from tearing more hair out!

The documentation really needs to be updated to include xdt:Locator="Match(name)"!

I've just-now posted updates to a bunch of StackOverflow posts (linked below) where people didn't understand why it wasn't working (it really doesn't help that it's currently so difficult to even see what our applicationHost.config files look like after transformation - why can't Kudu show them to us without us having to hack together ways of getting it?)

• https://stackoverflow.com/questions/35634361/where-should-allowedservervariables-tag-live-in-azure-website-applicationhost
• https://stackoverflow.com/questions/21666481/set-header-from-url-rewrite-on-azure-websites-appcmd-or-applicationhost-config/63213247#63213247
• https://stackoverflow.com/questions/58048138/azure-web-apps-fails-to-reverse-proxy-to-wordpress-site/63213228#63213228