HTTP Header Insertion
Table of Contents
9.1 (EoL)
Expand all | Collapse all
-
- Objects > Addresses
- Objects > Address Groups
- Objects > Regions
- Objects > Dynamic User Groups
- Objects > Application Groups
- Objects > Application Filters
- Objects > Services
- Objects > Service Groups
- Objects > External Dynamic Lists
- Objects > Custom Objects > Spyware/Vulnerability
- Objects > Custom Objects > URL Category
- Objects > Security Profiles > Antivirus
- Objects > Security Profiles > Anti-Spyware Profile
- Objects > Security Profiles > Vulnerability Protection
- Objects > Security Profiles > File Blocking
- Objects > Security Profiles > WildFire Analysis
- Objects > Security Profiles > Data Filtering
- Objects > Security Profiles > DoS Protection
- Objects > Security Profiles > GTP Protection
- Objects > Security Profiles > SCTP Protection
- Objects > Security Profile Groups
- Objects > Log Forwarding
- Objects > Authentication
- Objects > Decryption > Forwarding Profile
- Objects > Schedules
-
-
- Firewall Interfaces Overview
- Common Building Blocks for Firewall Interfaces
- Common Building Blocks for PA-7000 Series Firewall Interfaces
- Tap Interface
- HA Interface
- Virtual Wire Interface
- Virtual Wire Subinterface
- PA-7000 Series Layer 2 Interface
- PA-7000 Series Layer 2 Subinterface
- PA-7000 Series Layer 3 Interface
- Layer 3 Interface
- Layer 3 Subinterface
- Log Card Interface
- Log Card Subinterface
- Decrypt Mirror Interface
- Aggregate Ethernet (AE) Interface Group
- Aggregate Ethernet (AE) Interface
- Network > Interfaces > VLAN
- Network > Interfaces > Loopback
- Network > Interfaces > Tunnel
- Network > Interfaces > SD-WAN
- Network > VLANs
- Network > Virtual Wires
-
- Network > Network Profiles > GlobalProtect IPSec Crypto
- Network > Network Profiles > IPSec Crypto
- Network > Network Profiles > IKE Crypto
- Network > Network Profiles > Monitor
- Network > Network Profiles > Interface Mgmt
- Network > Network Profiles > QoS
- Network > Network Profiles > LLDP Profile
- Network > Network Profiles > SD-WAN Interface Profile
-
-
- Device > Setup
- Device > Setup > Management
- Device > Setup > Interfaces
- Device > Setup > Telemetry
- Device > Setup > Content-ID
- Device > Setup > WildFire
- Device > Log Forwarding Card
- Device > Config Audit
- Device > Administrators
- Device > Admin Roles
- Device > Access Domain
- Device > Authentication Sequence
-
- Security Policy Match
- QoS Policy Match
- Authentication Policy Match
- Decryption/SSL Policy Match
- NAT Policy Match
- Policy Based Forwarding Policy Match
- DoS Policy Match
- Routing
- Test Wildfire
- Threat Vault
- Ping
- Trace Route
- Log Collector Connectivity
- External Dynamic List
- Update Server
- Test Cloud Logging Service Status
- Test Cloud GP Service Status
- Device > Virtual Systems
- Device > Shared Gateways
- Device > Certificate Management
- Device > Certificate Management > Certificate Profile
- Device > Certificate Management > OCSP Responder
- Device > Certificate Management > SSL/TLS Service Profile
- Device > Certificate Management > SCEP
- Device > Certificate Management > SSL Decryption Exclusion
- Device > Response Pages
- Device > Server Profiles
- Device > Server Profiles > SNMP Trap
- Device > Server Profiles > Syslog
- Device > Server Profiles > Email
- Device > Server Profiles > HTTP
- Device > Server Profiles > NetFlow
- Device > Server Profiles > RADIUS
- Device > Server Profiles > TACACS+
- Device > Server Profiles > LDAP
- Device > Server Profiles > Kerberos
- Device > Server Profiles > SAML Identity Provider
- Device > Server Profiles > DNS
- Device > Server Profiles > Multi Factor Authentication
- Device > Local User Database > Users
- Device > Local User Database > User Groups
- Device > Scheduled Log Export
- Device > Software
- Device > Dynamic Updates
- Device > Licenses
- Device > Support
-
- Network > GlobalProtect > MDM
- Network > GlobalProtect > Device Block List
- Network > GlobalProtect > Clientless Apps
- Network > GlobalProtect > Clientless App Groups
- Objects > GlobalProtect > HIP Profiles
-
- Use the Panorama Web Interface
- Context Switch
- Panorama Commit Operations
- Defining Policies on Panorama
- Log Storage Partitions for a Panorama Virtual Appliance in Legacy Mode
- Panorama > Setup > Interfaces
- Panorama > High Availability
- Panorama > Administrators
- Panorama > Admin Roles
- Panorama > Access Domains
- Panorama > Device Groups
- Panorama > Plugins
- Panorama > Log Ingestion Profile
- Panorama > Log Settings
- Panorama > Scheduled Config Export
End-of-Life (EoL)
HTTP Header Insertion
To enable the firewall to manage web application access
by inserting HTTP headers and their values into HTTP requests, select ObjectsSecurity ProfilesURL FilteringHTTP Header Insertion.
The firewall supports header insertion for HTTP/1.x traffic
only; the firewall does not support header insertion for HTTP/2
traffic.
You can create insertion entries based on a predefined HTTP header
insertion type or you can create your own custom type. Header insertion
is typically performed for custom HTTP headers but you can also
insert standard HTTP headers.
Header insertion occurs when:
- An HTTP request matches a Security policy rule with one or more configured HTTP header insertion entries.
- A specified domain matches the domain found in the HTTP Host header.
- The action is anything other than block.
The firewall can perform HTTP header insertion only for
the GET, POST, PUT, and HEAD methods.
If you enable HTTP header insertion and the identified header
is missing from a request, the firewall inserts the header. If the
identified header already exists in the request, then the firewall
overwrites the header values with the values that you specify.
Add an insertion entry or select an existing
insertion entry to modify it. When needed, you can also select an
insertion entry and Delete it.
The default block list action for a new HTTP header insertion
entry is Block. If you want a different action,
go to URL Filtering Categories and select
the appropriate action. Alternatively, add the insertion entry to
a profile that is configured with the desired action.
HTTP Header Insertion Settings | Description |
---|---|
Name | The Name for this
HTTP header insertion entry. |
Type | The Type of entry
you want to create. Entries can be either predefined or custom.
The firewall uses content updates to populate and maintain predefined
entries. If you want to include the username in the HTTP header,
select Dynamic Fields. |
Domains | Header insertion occurs when a domain in
this list matches the Host header of the HTTP request. If
you are creating a predefined entry, the domain list is predefined
in a content update. This is sufficient for most use cases but you
can add or delete domains as needed. If you want to create
a custom entry, Add at least one domain to
this list. Each domain name can be up to 256 characters and
you can identify a maximum of 50 domains for each entry. You can
use an asterisk (*) as a wildcard character, which matches any request
to the specified domain (for example, *.etrade.com). |
Header | When you create a predefined entry, the
Header list is pre-populated by a content update. This is sufficient
for most use cases but you can add or delete headers as needed. When
you create a custom entry, add one or more headers (up to a total
of five) to this list. Header names can have up to 100 characters
but cannot include spaces. If you want to include the username
in the HTTP header, select X-Authenticated-User then
select the Value, or Add a
new header. |
Value | Configure the Value using
a maximum of 512 characters. The header value varies depending on
what information you want to include in the HTTP header for the
specified domains. For example, manage user access to SaaS applications by selecting predefined types or by
using custom entries. To
include the username in the HTTP header, select the domain and username
format that the security appliance requires:
Alternatively,
enter a custom format using the ($user) and ($domain) dynamic
tokens (for example, ($user)@($domain)). The
firewall populates the user and domain dynamic tokens using the
primary username in the group mapping profile. Use each ($user) and ($domain) dynamic
token only once per value. |
Log | Select Log to enable
logging of this header insertion entry. |