|
4 | 4 | txn_box: |
5 | 5 |
|
6 | 6 | # Set the ct-policy variable for later use in the transaction. |
7 | | - - when: creq |
| 7 | + - when: ua-req |
8 | 8 | do: |
9 | | - - with: cssn-proto<tls> |
| 9 | + - with: inbound-protocol<tls> |
10 | 10 | select: |
11 | 11 | - prefix: "tls" |
12 | 12 | do: |
13 | 13 | - var<ct-policy>: |
14 | | - - creq-host |
| 14 | + - ua-req-host |
15 | 15 | - filter: |
16 | 16 | - match: "u.protected.com" |
17 | 17 | replace: "enforce" |
18 | 18 | - replace: "report-uri=\"http://cane.example.com/path/cane?src=examplecom-expect-ct-report-only\"" |
19 | 19 |
|
20 | 20 | # Remove all Cookies going to protected.com |
21 | | - - when: creq |
| 21 | + - when: proxy-req |
22 | 22 | do: |
23 | | - - with: creq-host |
| 23 | + - with: proxy-req-host |
24 | 24 | select: |
25 | 25 | - tld: "protected.com" # protected.com or any subdomain |
26 | 26 | do: |
27 | | - - creq-field<Cookie>: NULL |
| 27 | + - proxy-req-field<Cookie>: NULL |
28 | 28 |
|
29 | 29 | # Filter out set-cookie fields concerning protected.com |
30 | | - - when: ursp |
| 30 | + - when: upstream-rsp |
31 | 31 | do: |
32 | | - - ursp-field<Set-Cookie>: # filter set-cookie fields |
33 | | - - ursp-field<Set-Cookie> # get the current list |
| 32 | + - upstream-rsp-field<Set-Cookie>: # filter set-cookie fields |
| 33 | + - upstream-rsp-field<Set-Cookie> # get the current list |
34 | 34 | - filter: # keep the ones |
35 | 35 | - none-of: # that do *not* match |
36 | 36 | - rxp<nc>: "domain=(?:[^=]*[.])?protected[.]com" # this regex |
37 | 37 |
|
38 | | - - when: prsp |
| 38 | + - when: proxy-rsp |
39 | 39 | do: |
40 | 40 | # set a referrer policy if not already present. |
41 | | - - prsp-field<Referrer-Policy>: [ prsp-field<Referrer-Policy>, { else: "no-referrer-when-downgrade" } ] |
| 41 | + - proxy-rsp-field<Referrer-Policy>: |
| 42 | + - proxy-rsp-field<Referrer-Policy> |
| 43 | + - else: "no-referrer-when-downgrade" |
42 | 44 |
|
43 | 45 | # For proxy response, fix up (add) the cross site fields if it's TLS. |
44 | | - - with: cssn-proto<tls> |
| 46 | + - with: inbound-protocol<tls> |
45 | 47 | select: |
46 | 48 | - prefix: "tls" |
47 | 49 | do: |
48 | | - - prsp-field<Expect-CT>: "max-age=31536000, {var<ct-policy>}" |
49 | | - - prsp-field<X-XSS-Protection>: "1; mode=block" |
50 | | - - prsp-field<X-Content-Type-Options>: "nosniff" |
| 50 | + - proxy-rsp-field<Expect-CT>: "max-age=31536000, {var<ct-policy>}" |
| 51 | + - proxy-rsp-field<X-XSS-Protection>: "1; mode=block" |
| 52 | + - proxy-rsp-field<X-Content-Type-Options>: "nosniff" |
51 | 53 |
|
52 | 54 | sessions: |
53 | 55 |
|
|
0 commit comments