Web Agent Guides › Web Agent Configuration Guide › SSO Security Zones › HTTP Header Settings

HTTP Header Settings

Use any of the following settings to control URL processing:

• Remove the Server HTTP header to accommodate the URLScan utility.

Remove the Server HTTP Header if Using the URLScan Utility

If you want to use the URLScan utility from Microsoft to remove the Server HTTP Header from the responses your IIS Web server sends, you also need to set the following parameter for your IIS Web Agent:

SuppressServerHeader

Prevents an IIS Web Agent from returning the Server HTTP Header in its responses. When the value of this parameter is set to no, the Web Agent sends the Server header with its responses and the IIS Web server passes it along to the client. When the value of this parameter is set to yes, the web agent does not send the Server header in its responses.

Default: No

The URLScan utiltiy removes the header from the IIS server's responses, while hte SuppressServerHeader parameter removes the header from the Web Agent's responses. Both the utility and the parameter must be set to prevent the Server header from being sent to the client in all responses.

To keep the Web Agent from sending the Server header in responses, set the value of the SuppressServerHeader parameter to yes.

URL Settings

Use any of the following settings to control how URLs are processed:

• Specify the protocol using lowercase characters.
• Decode query data in a URL.
• Set a maximum URL size.

Specify Redirect URL Protocols with Lowercase Characters

If you protect legacy applications that do not confirm to RFC 2396 with a forms-based authentication scheme, and you need the protocol portions of URLs to be lowercase, then set the following parameter:

LowerCaseProtocolSpecifier

Specifies whether the scheme (protocol) portion of a redirect URL uses only lowercase characters. This configuration parameter accommodates legacy applications that do not confirm to RFC 2396. This RFC states that applications must handle the protocol portion of a URL in both uppercase and lowercase. Change this parameter in any of the following situations:

• You use legacy applications that do not confirm to RFC 2396.
• Your redirect URLS contain query data.
• You use an HTML-forms (FCC) authentication scheme.

Default: No (uppercase characters are used HTTP, HTTPS).

Example: Yes (lowercase characters are used http, https).

To specify lowercase protocols for the URLs in your environment, set the value of the LowerCaseProtocolSpecifier parameter to yes.

Decode Query Data in a URL

To have the Web Agent’s Base64 algorithm decode a URL’s query data before calling the Policy Server (so the Policy Server sees the proper resource), use the following parameter:

DecodeQueryData

Specifies whether the Web Agent decodes the query data in a URL before calling the Policy Server. Set this parameter to yes if you need do any of the following tasks in your environment:

• If you need to ensure the rules filer acts against the proper string.
• If you need to or write rules against the data in a query string.

Default: No

To have the Web Agent decode the query data in a URL before calling the Policy Server, set the value of the DecodeQueryData parameter to yes.

Set a Maximum URL Size

You can increase the maximum URL size that a Web Agent can handle with the following parameter:

MaxUrlSize

Specifies the maximum size (in bytes) of a URL that a Web Agent can handle. Because different web servers have different limitations on URL length, check the documentation from your web server vendor before setting this parameter.

Default: 4096 B

To change the maximum URL size, change the number of bytes specified in the MaxUrlSize parameter.