Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 6: Configuring Application Defenses
Creating Web or Secure Web Application Defenses
About the HTTP
Reply tab
164
The HTTP Reply tab allows you to configure header filtering for HTTP replies.
Follow the steps below.
Note: The fields in this tab will be disabled unless you select the HTTP Reply
check box on the Enforcements tab. Also, this tab is not available for Secure Web if
you select Client in the Type field.
1 In the Filter Option field, determine whether you want to allow or deny the
header types you select, as follows:
• Allow—Select this option to allow all header types that are selected in
the HTTP Reply Header Filter Types window. All other types will be
denied.
• Deny—Select this option to deny all header types that are selected
selected in the HTTP Reply Header Filter Types window. All other types
will be allowed.
2 Select the type of HTTP header filtering you want to allow or deny in the
Selected HTTP Reply Header Filter Types area. The following options are
available:
Note: The X-* filter type is a wildcard filter that will allow or deny all X-xxx reply
headers (commonly found in user-defined headers). If you create an Allow list
and do not include the X-* filter type, most Web traffic will be denied.
• None—Select this option if you want to deselect all HTTP reply header
filter types in the list. (You can also deselect all of the types by clicking
Deselect All.)
• Standard—Select this option if you want to automatically select all of the
header types contained in the list. (You can also select all header types
by clicking Select All.)
• Paranoid—Select this option if you want to exclude all options not
defined in the RFC.
• Custom—Select this option if you want to manually configure which
HTTP reply header types you will allow or deny.
3 In the Denied Header Action area, select one of the following options:
• Block Entire Page—Select this option to block the entire page when an
HTTP reply header is denied.
• Allow Page Through Without Denied Headers—Select this option to
mask the denied HTTP reply header, but still allow the page to be
viewed. (A denied HTTP reply header will be scrubbed.)