Edge SWG performs DNS resolution of hostname in HTTP Referer header

Products

• ProxySG Software - SGOS
• ISG Proxy

Issue/Introduction

It is observed that Edge SWG performs DNS resolution of hostname in HTTP Referrer field.

For example:

GET http://www.dhl.com/ HTTP/1.1
Host: www.dhl.com
User-Agent: curl/8.9.1
Accept: */*
Proxy-Connection: Keep-Alive
Referer: http://example.com  <----!!!

Edge SWG will perform DNS resolution of host "example.com" (in addition to www.dhl.com)

 

Cause

This is expected behavior when policy includes custom category that includes IP addresses.

Example:

define category abc
    1.1.1.1
end

Resolution

If this behavior is not intended then category definition should not include IP addresses.