Allow or Deny content by the Content-Length header via policy
Article ID: 166274
Updated On:
Products
Issue/Introduction
Control file downloads based on the Content-Length header via policy using the Edge SWG (ProxySG) Virtual Policy Manager (VPM) or Content Policy Language (CPL).
Resolution
To control file size downloads via CPL
Use the response.header.content-length.as_number condition.
For example, to deny file downloads of files greater than 10 MB use the following CPL:
<Proxy> response.header.content-length.as_number=10485760.. DENY
The ".." is a range indicator.
For more information, see the technical documentation for response.header.content-length.as_number=
To control file size downloads via VPM
- Launch the Web VPM from the Edge SWG (ProxySG) appliance Management Console Configuration > Policy > Visual Policy Manager or via the link in the upper right hand corner.
- Create or edit a Web Access Layer.
- In the layer, create a rule with the following properties:
Source: Any, or user or group.
Destination: New > Response Header >Content-Length. Enter a regular expression (regex) for a content-length; see the Examples section following these steps.
Action: Allow or Deny.
Since the VPM uses regex to make a comparison, it will use more CPU to evaluate the policy. To approximate 10 MB using regex, you would use regex to allow all 7 digit values from 0 - 9,999,999 which would be:
^[0-9]{1,7}$
It's a little more tricky for expressing 30 MB in regex. Essentially, you would allow all values like in the 10 MB case, but including all values with a leading 1 followed by any 7 digits and a leading 2 followed by any 7 digits:
^[0-9]{1,7}$|^[1-2][0-9]{7}$
The left side of the "|" accounts for up to 10 MB and the right side of the "|" accounts for the values with a leading 1 followed by any 7 digits and a leading 2 followed by any 7 digits.
For convenience, here is a table of regex expressions for common values:
File Size (byte range) |
Regular Expression |
| 1 MB (0 - 999 999) | ^[0-9]{1,6}$ |
| 2 MB (0 - 1 999 999) | ^[0-9]{1,6}$|^1[0-9]{6}$ |
| 5 MB (0 - 4 999 999) | ^[0-9]{1,6}$|^[1-4][0-9]{6}$ |
| 10 MB (0 - 9 999 999) | ^[0-9]{1,7}$ |
| 15 MB (0 - 14 999 999) | ^[0-9]{1,7}$|^1[0-4][0-9]{6}$ |
| 20 MB (0 - 19 999 999) | ^[0-9]{1,7}$|^1[0-9]{7}$ |
| 30 MB (0 - 29 999 999) | ^[0-9]{1,7}$|^[1-2][0-9]{7}$ |
| 50 MB (0 - 49 999 999) | ^[0-9]{1,7}$|^[1-4][0-9]{7}$ |
| 100 MB (0 - 99 999 999) | ^[0-9]{1,8}$ |
| 150 MB (0 - 149 999 999) | ^[0-9]{1,8}$|^1[0-4][0-9]{7}$ |
| 200 MB (0 - 199 999 999) | ^[0-9]{1,8}$|^1[0-9]{8}$|^2[0-4][0-9]{7}$ |
| 300 MB (0 - 299 999 999) | ^[0-9]{1,8}$|^[1-2][0-9]{8}$ |
| 500 MB (0 - 499 999 999) | ^[0-9]{1,8}$|^[1-4][0-9]{8}$ |
| 1000 MB (0 - 999 999 999) | ^[0-9]{1,9}$ |
| 2000 MB (0 - 1 999 999 999) | ^([0-9]{1,9}|[1][0-9]{1,9})$ |
| 3000 MB (0 - 2 999 999 999) | ^([0-9]{1,9}|[1-2][0-9]{1,9})$ |
Feedback
