Redirected URL is not blocked when accessed from an allowed parent URL
Article ID: 405492
Updated On:
Products
Issue/Introduction
A specific URL is not being blocked by policy if the user accesses it via a redirect from a parent URL
The destination URL belongs to a category that is explicitly blocked in the policy.
If the user navigates directly to the blocked URL, the block rule works as expected.
If the user accesses an allowed parent URL that redirects to the blocked URL, the traffic bypasses the block rule and is permitted.
Environment
Transparent Proxy - WSSA
Cause
This issue occurs due to HTTP/2 Coalescing (also known as connection reuse) combined with a lack of SSL Interception.
HTTP/2 allows web browsers to reuse an existing, open TLS connection for a new request if the new domain resolves to the same IP address and is covered by the same TLS certificate (such as a wildcard or Subject Alternative Name certificate).
When a user navigates to the allowed parent URL, a connection is established, and the proxy reads the Server Name Indication (SNI) in the clear text TLS handshake, allowing the traffic. When the browser is redirected to the blocked child URL, it reuses that same encrypted tunnel. Because the traffic is not being decrypted, the proxy cannot see the underlying HTTP request for the blocked URL and relies entirely on the initial allowed SNI, permitting the traffic through.
Resolution
To resolve this issue, you must Enable SSL Interception (SSL Decryption) for the affected traffic.
Additional Information
When SSL Interception is enabled, the proxy decrypts the traffic and inspects the actual HTTP host headers and underlying URLs rather than relying solely on the SNI. This allows the proxy to evaluate each individual request against your web access policies and successfully block the destination URL, even if the browser attempts to reuse the connection via HTTP/2 coalescing.
Feedback
