Configure HTTP Header Logging

1. Open a URL Filtering profile.

   1. Select ObjectsSecurity ProfilesURL Filtering, then Add a new profile or select an existing one.
2. Select HTTP Header Logging.
3. Configure which headers to capture.

   • Enable Log all HTTP headers to capture every request and response header.
   • To capture specific request headers, under Request Headers, Add each header name and set its Max Header Length and Truncate Headers values.

   • To capture specific response headers, under Response Headers, Add each header name and set its Max Header Length and Truncate Headers values.

   Request headers can contain personally identifiable information (PII) such as cookies and authorization tokens. A privacy notice appears the first time you enable request header logging.

   When you log both request and response headers, the firewall generates two URL filtering log entries per resource. Use the URL Index and Direction fields to correlate the entries.
4. (Optional) Enable Enable logging of response code in HTTP response to force a response log entry to be generated when response headers are not logged.

   • The HTTP status code is captured in every response log entry, regardless of this setting.
   • When response header logging is disabled or no response headers are matched, enabling this option forces a response log entry to capture the status code.
5. For Max Header Length, enter the maximum number of bytes to capture per header value (1–4,092 bytes).

   The limit applies to the header value only and excludes the header name, colon, and any whitespace following the colon. Individual headers added to the Request Headers or Response Headers tables can override this value.

   If Max Header Length is set to 1 and Enable truncation of headers that exceed the max header length limit is enabled, only the header name is logged.
6. (Optional) Enable Enable truncation of headers that exceed the max header length limit to capture headers up to the Max Header Length limit.

   When disabled, headers that exceed the limit are not logged at all.
7. Select OK to save the profile.
8. Apply the URL Filtering profile to a Security policy rule and set the URL category action to alert.

   Select PoliciesSecurity, select a rule, and on the Actions tab assign the profile.

   An allow action does not generate a URL filtering log. A block action terminates the session before header logging occurs. Set the URL category to alert to ensure logs are generated.
9. Commit and Push the configuration.
10. Verify that the headers are captured in URL filtering logs. Go to MonitorLogsURL Filtering and open a log entry for traffic matching the profile. The Request Headers and Response Headers columns display the captured header values. If you enabled response code logging, the Status Code column displays the HTTP response status code.

    • Response status code will be populated if response headers are logged regardless of whether response code logging is enabled.
    • Enabling response code logging forces a response log entry with the status code populated, even if response headers are unmatched or not configured.