How to 'cloak' or 'rename' page name/location/url for user but still allow external site to correctly read the true url via HTTP_REFERER - vbscript

Question

My website has a partnership with external sites for members that allows access. The only way our members can access the external site is first if they are authenticated on our site, and then if they visit the external site from a specific page. Such as:
Our partner/external site checks HTTP_REFERER and verifies that the user is coming from the exact URL above and then allows them access.
So, we are stuck with this URL unless we request the partner change the URL on their side as well, which is a long complicated process.
I would like to make this URL prettier, but allow the external site to view the correct or "true" URL when the do an HTTP_REFERER so that they can still allow access for authenticated users from our site.
Some notes on my specific situation:
I am running pages on an IIS 7 Server.
Pages are .asp pages and utilizing Classic ASP VB server-side language.
I do not have access
to change anything on the external server checking the HTTP_REFERER
location.
I have tried doing:
<% Server.Transfer("/mynewpage/") %>
and that works in the sense that it makes the URL prettier while keeping the page at the same location. But the external site also reads the page as coming from "www.example.org/mynewpage/", which "breaks" our authentication because it's not the predefined page they are looking for to check authentication.
Is there another way that I can "cloak" or "rename" my URL to make it prettier, while still allowing the external site to correctly read the "True" URL when they do an HTTP_REFERER?

Answer 1

If your host has the URL rewrite module installed (which they probably will) then you can put rewrite rules into the system.webserver section of web.config eg
<rewrite>
<rules>
<rule name="ArticleDetail" stopProcessing="true">
<match url="^article/([^/]+)/?$"/>
<conditions>
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true"/>
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true"/>
</conditions>
<action type="Rewrite" url="article.asp?id={R:1}"/>
</rule>
<rule name="Articles" stopProcessing="true">
<match url="^articles$"/>
<conditions>
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true"/>
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true"/>
</conditions>
<action type="Rewrite" url="articles.asp"/>
</rule>
</rules>
</rewrite>
This is for standard master/detail pages called articles.asp and article.asp. yoururl/articles will find articles.asp and yoururl/article/30 will find articles.asp?id=30
The alternative is to set up a custom 404 page and use server.transfer in that. You would also use web.config to define your 404 page, but the rewrite engine is easier IMO. Using either approach, both the "pretty" URL and the original url would find the page.
Note that if you have IIS installed on your own machine you can use the Rewrite rule creator in that. When you use it you'll find that it's added the rules it created to web.config