WSM User Guide - WatchGuard Technologies

Configuring the HTTP ProxyBrowsers usually use POST operations to send data to a web site. Many web pages get information fromthe end user such as location, e-mail address, and name. If you disable the POST command, the Fireboxdenies all POST operations to web servers on the external network. This features can prevent your usersfrom sending information to a web site on the external network.The HTTP proxy supports request methods: HEAD, GET, POST, OPTIONS, PUT, and DELETE. (For HTTP-Server, the proxy supports these request methods by default: HEAD, GET, and POST. OPTIONS, PUT, andDELETE are added but are disabled.) You can also add CONNECT and TRACE, but no other request methodsare supported at this time. If you configure a rule to allow other request methods and your browsertries to use them, you get an error with the text: “Method unsupported.”1 From the Categories section, select Request Methods.2 Do the steps used to create rules. For more information, see “Defining Rules” on page 79.Setting HTTP request URL pathsYou use URL path rules to filter the content of the host, path, and query-string components of a URL.Here are examples of how to block content using HTTP request URL paths:• To block all pages that have the host name www.test.com, type the pattern:www.test.com*• To block all paths containing the word “sex”, on all web sites: *sex*• To block URL paths ending in “*.test”, on all web sites: *.testNoteUsually, if you filter URLs with the HTTP request URL path ruleset, you must configure a complex patternthat uses full regular expression syntax and the advanced view of a ruleset. It is easier and gives betterresults to filter based on header or body content type than it is to filter by URL path.1 From the Categories section, select URL paths.2 Do the steps used to create rules. For more information, see “Defining Rules” on page 79.Setting HTTP request header fieldsThis ruleset supplies content filtering for the full HTTP header. By default, the Firebox uses exact matchingrules to strip Via and From headers, and allows all other headers. This ruleset matches against the fullheader, not only the name. Thus, to match all values of a header, type the pattern: “[header name]:*”. Tomatch only some values of a header, replace the asterisk (*) wildcard with a pattern. If your pattern doesnot start with an asterisk (*) wildcard, include one space between the colon and the pattern when typingin the Pattern text box. For example, type: [header name]: [pattern] and not [header name]:[pattern].Note that the default rules do not strip the Referer header, but do include a disabled rule to strip thisheader. To enable the rule, select Change View. Some web browsers and software applications mustuse the Referer header to operate correctly.1 From the Categories section, select Header Fields.2 Do the steps used to create rules. For more information, see “Defining Rules” on page 79.Setting HTTP request authorizationThis rule sets the criteria for content filtering of HTTP Request Header authorization fields. When a webserver starts a “WWW-Authenticate” challenge, it sends information about which authentication methodsit can use. The proxy puts limits on the type of authentication sent in a request. It uses only the176 WatchGuard System Manager