Require Specific Headers

Website, Application, Performance Security
1

What is the name of the domain?

https://microdata.pages.dev/

What is the issue you’re encountering

Rules not working

What steps have you taken to resolve the issue?

I want all the three headers must be present in requests. But it works even if two headers exist…
(not any(lower(http.request.headers.names[])[] eq “accept”)) or
(not any(lower(http.request.headers.names[])[] eq “accept-language”)) or
(not any(lower(http.request.headers.names[])[] eq “accept-encoding”))

What is the current SSL/TLS setting?

Off

What are the steps to reproduce the issue?

(not any(lower(http.request.headers.names[])[] eq “accept”)) or
(not any(lower(http.request.headers.names[])[] eq “accept-language”)) or
(not any(lower(http.request.headers.names[])[] eq “accept-encoding”))

3

The pages.dev domain belongs to Cloudflare so your rules won’t have any effect.

If you use a custom domain instead…

…then your rules will act on that. You can redirect microdata.pages.dev to your custom domain using a bulk redirect…

1 Like
4

Thanks for your response. I’m using custom domain now but issue persists.

5

What is the custom domain?

7

If you require all 3 headers, otherwise block, then the rule should be like…
not (expression1 AND expression2 AND expression3)

8

I am using the same only but same issue –

not (
    any(lower(http.request.headers.names[*])[*] == "accept") and
    any(lower(http.request.headers.names[*])[*] == "accept-language") and
    any(lower(http.request.headers.names[*])[*] == "accept-encoding")
)