URL Redirect Doesn't Match When Trailing Characters Are Appended

Products

• ISG Proxy
• Cloud Secure Web Gateway - Cloud SWG
• Management Center

Issue/Introduction

Navigating to a URL without a trailing slash (e.g., https://example.com/login) redirects the browser to an SSO login page. Accessing the exact URL with a trailing slash (e.g., https://example.com/login/) bypasses the redirect & loads the web page we are attempting to redirect.

Environment

Product: Edge SWG / ProxySG
Policy: Visual Policy Manager (VPM) or Content Policy Language (CPL)
Browser: All
Deployment: SaaS & On-Premises

Cause

The VPM interface defaults to an Exact Match field. If an administrator types /login into this field, SGOS doesn't compile a substring match. Instead, it compiles the rule as url.path.exact="/login". This evaluates the path and only matches the contents exactly as provided, including the forward slash. A trailing slash is outside of this boundary, causing the match to fail.

Resolution

Configure the policy engine to compile the destination object as url.path.substring="login". SGOS will then evaluate the path portion only, ignoring any slashes, query strings, or fragments.

Visual Policy Manager (VPM) The VPM interface hides the required modifier inside the Advanced Match dialogue.

1. Open the Visual Policy Manager.

2. Locate the layer containing the redirect rule.

3. Click the Destination object & select Edit.

4. Select the Advanced Match radio button. This action reveals discrete drop-down menus for the scheme, host, port, & path fields.

5. In the Path Operator row, select Contains from the drop-down menu.

6. Enter the "login" (without quotes) in the text field.

7. Click Apply
   
   
8. Click Set

9. Click Apply Policy.

Content Policy Language (CPL)

To configure this via CPL, use the substring evaluation: url.path.substring="/login"

Additional Information

 

• Review Article 427167 for more information on how 302 redirects interact with SAML/SSO payloads.
• To speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.
• Subscribe to this article to be updated on any additional fix status or policy recommendations: How to subscribe to a Knowledge Article.