Delete the X-​​Bluecoat-​​via Header on Your ProxySG

It is part of secur­ity prac­tice to restrict inform­a­tion about your internal net­work from being exposed. It is part of the RFC and thus man­dat­ory for a Proxy Server to insert an X-​​Bluecoat-​​Via header so as to advise the receiv­ing server that the request has been prox­ied. Most likely, this was done so that the server could be noti­fied that a proxy server was used, but in recent times applic­a­tions are usu­ally proxy-​​aware and the server does not need this inform­a­tion (and likely this fea­ture was never used.

It is con­sidered best prac­tice to remove inform­a­tion that would inform a poten­tial attacker about what sys­tems you are using. This HTTP header is send­ing a inform­a­tion about the vendor of your secur­ity appli­ance and should be suppressed.

You mist want to review this art­icle on how to insert the con­fig­ur­a­tion into your system


<Proxy>
action.xvia(yes)
define action xvia
delete( request.header.X-BlueCoat-Via )
end


Edit: Thanks to Andrew Thomas who points out the fol­low­ing:
The pur­pose of the X-​​Bluecoat-​​Via header is to allow blue­coat devices to sense and deal with for­ward­ing loops i.e. if a blue­coat sees it’s own header in an incom­ing request it knows that some­thing has gone wrong with for­ward­ing and the request should be dropped.

Clipping these head­ers off your requests at the edge of your net­work is a good idea, but care should be taken before remov­ing these head­ers from prox­ies which aren’t the last device in a proxy chain.

Please rate this post:

(No Ratings Yet)

 Loading ...