Error: 429 too many requests when performing Google searches

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

In CloudSWG, when "Advanced File Inspection" is enabled and there's a threat protection rule to block the group "Executables (33)", Google searches may return 429s (too many requests).

Environment

• CloudSWG

Cause

Google services at times will depend on google.com/sgasync but will return the content type "application/octet-stream".  Since content type "application/octet-stream" is raw binary data, it is treated like an executable and thus, bundled with the "Executables (33)" group within CloudSWG.  Advanced File Inspection will treat this content type with a high degree of suspicion and thus block it. 

This will in turn, cause the client to continually send repeat requests thus spamming the OCS.  When a threshhold is hit, it triggers google.com/sorry/index which redirects the client to captcha and a 429 is returned.

Resolution

1. Create an allow rule for "google.com/sgasync" in threat protection.

2. Place the rule above the block "Executables (33)" group.