Cloudflare Docs
Cloudflare-One
Visit Cloudflare Zero Trust on GitHub
Set theme to dark (⇧+D)

HTTP policies

HTTP policies allow you to filter HTTP traffic on the L7 firewall. Gateway will intercept all HTTP and HTTPS traffic and apply the rules you have configured in your policy to either block, allow, or override specific elements such as websites, IP addresses, and file types.

An HTTP policy consists of an Action as well as a logical expression that determines the scope of the policy. To build an expression, you need to choose a Selector and an Operator, and enter a value or range of values in the Value field.

Actions

Actions in HTTP policies allow you to choose what to do with a given set of elements (domains, IP addresses, file types, and so on). You can assign one action per policy.

Allow

The Allow action allows outbound traffic to reach destinations you specify within the Selectors and Value fields. For example, the following configuration allows traffic to reach all websites we categorize as belonging to the Education content category:

SelectorOperatorValueAction
Content CategoriesinEducationAllow

Block

The Block action blocks outbound traffic from reaching destinations you specify within the Selectors and Value fields. For example, the following configuration blocks users from being able to upload any file type to Google Drive:

SelectorOperatorValueAction
ApplicationinGoogle DriveBlock
Upload Mime Typematches regex.*

Isolate

For more information on this action, refer to the documentation on Browser Isolation policies .

Do Not Isolate

For more information on this action, refer to the documentation on Browser Isolation policies .

Do Not Inspect

Do Not Inspect lets you bypass certain elements from inspection. To bypass a site, your policy must match against the host in order to prevent HTTP inspection from occurring on both encrypted and plaintext traffic.

The L7 firewall will evaluate Do Not Inspect rules before any subsequent Allow or Block rules. For encrypted traffic, Gateway uses the Server Name Indicator (SNI) in the TLS header to determine whether to decrypt the traffic for further HTTP inspection against Allow or Block rules. All Do Not Inspect rules are evaluated first to determine if decryption should occur. This means regardless of precedence in a customer’s list of rules, all Do Not Inspect rules will take precedence over Allow or Block rules.

Do Not Scan

When an admin enables AV scanning for uploads and/or downloads, Gateway will scan every supported file. Admins can selectively choose to disable scanning by leveraging the HTTP rules. For example, to prevent AV scanning of files uploaded to or downloaded from example.com, an admin would configure the following rule:

SelectorOperatorValueAction
HostnameMatches Regex.*example.comDo Not Scan

When a Do Not Scan rule matches, nothing is scanned, regardless of file size or whether the file type is supported or not.

Selectors

Gateway matches HTTP traffic against the following selectors, or criteria:

Application

You can apply HTTP policies to a growing list of popular web applications. Refer to the Application and app types page for more information.

UI nameAPI example
Applicationany(app.ids[*] in {505}

A list of supported applications and their ID numbers is available through the Gateway API endpoint.

Content Categories

UI nameAPI example
Content Categoriesnot(any(http.request.uri.content_category[*] in {1}))

Destination Continent

The continent to which the request is destined. Geolocation is determined from the target IP address.

UI nameAPI example
Destination Continent IP Geolocationhttp.dst.geo.continent == "North America"

Destination Country

The country that the request is destined for. Geolocation is determined from the target IP address.

UI nameAPI example
Destination Country IP Geolocationhttp.dst.geo.country == "Russia"

Destination IP

UI nameAPI example
Destination IPhttp.dst.ip == "10.0.0.0/8"

Domain

UI nameAPI example
Domainhttp.request.domains == "a.example.com"

Download and Upload Mime Type

These selectors depend on the Content-Type header being present in the request (for uploads) or response (for downloads).

UI nameAPI example
Download Mime Typehttp.download.mime == "image/png\"
UI nameAPI example
Upload Mime Typehttp.upload.mime == "image/png\"

Host

UI nameAPI example
Hosthttp.request.host == ".*example\.com"

HTTP Method

UI nameAPI example
HTTP Methodhttp.request.method == "GET"

HTTP Response

UI nameAPI example
URLhttp.response.status_code == "200"

Device Posture

With the Device Posture selector, admins can use signals from end-user devices to secure access to their internal and external resources. For example, a security admin can choose to limit all access to internal applications based on whether specific software is installed on a device and/or if the device or software are configured in a particular way.

UI nameAPI example
Passed Device Posture Checksany(device_posture.checks.passed[*] in {"1308749e-fcfb-4ebc-b051-fe022b632644"})

Security Categories

UI nameAPI example
Security Categoriesany(http.request.uri.category[*] in {1})

Source Continent

The continent of the user making the request. Geolocation is determined from the device’s public IP address (typically assigned by the user’s ISP).

UI nameAPI example
Source Continent IP Geolocationhttp.src.geo.continent == "North America"

Source Country

The country of the user making the request. Geolocation is determined from the device’s public IP address (typically assigned by the user’s ISP).

UI nameAPI example
Source Country IP Geolocationhttp.src.geo.country == "Russia"

Source IP

UI nameAPI example
Source IPhttp.src.ip == "10.0.0.0/8"

URL

UI nameAPI example
URLnot(any(http.request.uri.content_category[*] in {1}))

URL Path

UI nameAPI example
URL Pathhttp.request.uri.path == \"/foo/bar\"

URL Path and Query

UI nameAPI example
URL Path and Queryhttp.request.uri.path_and_query == \"/foo/bar?ab%242=%2A342\"

URL Query

UI nameAPI example
URL Querynot(http.request.uri in $%s)

Users

The User, User Group, and SAML Attributes selectors require Gateway with WARP mode to be enabled in the Zero Trust WARP client, and the user to be enrolled in the organization via the WARP client. For more information on identity-based selectors, refer to the Identity-based policies page.

Operators

Operators are the way Gateway matches traffic to a selector. When you choose a Selector in the dashboard policy builder, the Operator dropdown menu will display the available options for that selector.

OperatorMeaning
isexact match, equals
is notall except exact match
inin any of defined entries
not innot in defined entries
in listin a pre-defined list of entries
not in listnot in a pre-defined list of entries
matches regexregex evaluates to true
does not match regexall except when regex evals to true
greater thanexceeds the defined number
greater than or equal toexceeds or equals the defined number
less thanbelow the defined number
less than or equal tobelow or equals the defined number

Value

You can input a single value or use regular expressions to specify a range of values.

Gateway uses Rust to evaluate regular expressions. The Rust implementation is slightly different than regex libraries used elsewhere. For more information, refer to our guide for Using wildcards in subdomains and paths .

For example, if you want to match multiple domains, you could use the pipe symbol (|) as an OR operator. In Gateway, you do not need to use an escape character (\) before the pipe symbol. The following configuration blocks requests to two hosts if either appears in a request header:

SelectorOperatorValueAction
HostMatches regex.\*whispersystems.org |.\*signal.orgBlock

To evaluate if your regex matches, you can use Rustexp.