HTTP Header Referrer

[mmcastr]

Hi,

is it possible to build a security access rule based on http-header referrer field?

Someone have do it?

Regards

[BPry]

@mmcastr,

Kinda. The only way I can think of to actually acomplish this would be to build a custom application based on HTTP-Headers. If you do a pattern match you shouldn't have an issue pulling the referrer information. Then you can allow/block this application through your security policies. 

[mmcastr]

Hi @BPry

We have a scenario where Internet access is blocked by default for most of users and the access is allowed by a custom URL object that have a list of URL or FQDN.

I found a traffic related to one of the allowed FQDN that uses http referrer but is denied because the FQDN inside the URI is not inside the white list but it has into the http referrer the allowed FQDN.

Based on it I'm trying to allow this traffic based in this http field.

I didn't find the http referrer attribute inside the available options to http protocol when I was building the custom app.

As we don't have a testing environment to homologate this custom app I'd like to ask you if I'm in the right way to match this kind of traffic and allowed.

Below I put the options I worked to build the custom app.

Application / Signatures
  Signatures Name: http-scup
     Scope: Transaction
       Operator: Pattern Match
       Context: http-req-params
       Pattern: www.domain.com
         Qualifier: http-method GET

Thanks for your time.