Restricting access to GitHub.com using EdgeSWG

Products

• ISG Proxy

Issue/Introduction

You want to restrict the access to GitHub.com from personal and non-enterprise account. 

Resolution

To enforce the restriction, you will inject a header into all traffic going to GitHub endpoints.

Format of the header:

sec-GitHub-allowed-enterprise: ENTERPRISE-ID

The following CPL code can be used in EdgeSWG to restrict access to GitHub.com from personal or non-enterprise accounts, allowing access only from enterprise accounts:

define condition GitHubEnterpriseDestination
    url.domain="github.com"
    url.domain="githubcopilot.com"
    
end condition GitHubEnterpriseDestination

define action sec-GitHub-allowed-enterprise
        set(request.x_header.sec-GitHub-allowed-enterprise,"ENTERPRISE-ID")
end action sec-GitHub-allowed-enterprise

<Proxy>
    condition=GitHubEnterpriseDestination action.sec-GitHub-allowed-enterprise(yes) 

 

Note: You must read the article "restricting-access-to-githubcom-using-a-corporate-proxy" to ensure all the required changes on GitHub are completed before applying the CPL to EdgeSWG.