Create Custom HTTP Header Insertion Entries

If there are no upstream devices already decrypting HTTPS traffic, configure SSL Forward Proxy.
Add
a custom URL category for the SaaS application you are managing (
Objects
Custom Objects
URL Category
).
Specify a
Name
for the category.
Add
the domains specific to the SaaS application you are managing.
Create a Decryption Policy Rule and, as you follow this procedure, configure the following:
In the
Service/URL Category
tab,
Add
the
URL Category
that you created in the previous step.
In the
Options
tab, make sure the
Action
is set to
Decrypt
and that the
Type
is set to
SSL Forward Proxy
.
Edit or create a URL Filtering profile.
Select
HTTP Header Insertion
in the URL Filtering Profile dialog.
Add
an entry.
Specify a
Name
for this entry.
Select
Custom
as the
Type
.
Add
domains to the
Domains
list.
You can add up to 50 domains and each domain name can have up to 256 characters; wildcards are supported (for example, *.example.com).
HTTP header insertion occurs when a domain in this list matches the domain in the Host header of the HTTP request.
Add
headers to the
Headers
list.
You can add up to 5 headers, and each header can have up to 100 characters but cannot contain any spaces.
For each header, enter a
Value
.
Each header value can have up to 512 characters.
(
Optional
)
Log
insertion activity for the headers.
Click
OK
to save your changes.
Add
or edit a Security policy rule (
Policies
Security
) that allows users to access the SaaS application for which you are configuring this header insertion rule.
Choose the URL Filtering profile (
Actions
URL Filtering
) that you edited or created in Step 2.
Click
OK
to save and then
Commit
your changes.
Verify that access to the SaaS application is working in the way you expect. From an endpoint that is connected to your network:
Try to access an account or content that you expect to be able to access. If you cannot access the SaaS account or content, then the configuration is not working.
Try to access an account or content that you expect will be blocked. If you can access the SaaS account or content, then the configuration is not working.
If both of the previous steps work as expected, then you can View Logs (if you configured logging in step 4.6) and you should see the recorded HTTP header insertion activity.