Notify policy leaking URLs to origin server

Products

• ProxySG Software - SGOS

Issue/Introduction

The internal notify URL is being leaked to the web site that the user is trying to reach.

Resolution

By default the notify user object will add layer guards to the VPM policy. However, it does not do this for local policy. The ICAP best practice guide is known to cause this issue. It is caused by the following CPL:

<cache>
;    condition=__is_notify_internal response.icap_service(no)
    url.scheme=http condition=NOICAP response.icap_service(no)

This is caused by the NOICAP condition contains the VIDEO_AUDIO_with_NO_or_LARGE_CONTENT_LENGTH condition which contains the MEDIA_MIME_TYPES condition which has the following conditions:

    response.header.Content-Type="video/"
  response.header.Content-Type="application/streamingmedia"  ( and a number of other response headers).
 

Since this condition requires response headers, the content (at least the response headers) needs to be fetched from the OCS causing the leaking of the notify user object. Bug 131091 was raised for this issue. Engineering have advised that the best solution is to add the following layer guard to the <cache> layers:

'condition=!__is_notify_internal'

For example:

<cache> condition=!__is_notify_internal
;    condition=__is_notify_internal response.icap_service(no)
    url.scheme=http condition=NOICAP response.icap_service(no)