Skip to content

[Gateway] HTTP common policy API examples #18942

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 22 commits into from
Dec 27, 2024
Merged

[Gateway] HTTP common policy API examples #18942

Show file tree
Hide file tree
Changes from 20 commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
35997dd
Remove unnecessary partial
maxvp Dec 18, 2024
0220c19
Fix DNS formatting
maxvp Dec 18, 2024
5bef21b
Add lists example
maxvp Dec 18, 2024
d762203
Add block unauthorized applications
maxvp Dec 20, 2024
c27865b
Add get list partial
maxvp Dec 20, 2024
5a2b5b9
Remove get-list partial
maxvp Dec 20, 2024
849e81f
Add CIPA filter
maxvp Dec 20, 2024
df03757
Remove device posture for DNS policies
maxvp Dec 20, 2024
0cc6b8a
Add check user identity policy
maxvp Dec 20, 2024
04e4cc2
Add block content categories policies
maxvp Dec 20, 2024
ad867e8
Add block AI
maxvp Dec 26, 2024
2a2f6fb
Add check user identity policy
maxvp Dec 26, 2024
db8b926
Add DNI policy
maxvp Dec 26, 2024
6362f1c
Add first device posture check example
maxvp Dec 26, 2024
44d0385
Add device posture examples
maxvp Dec 26, 2024
f7a3377
Add isolation policies
maxvp Dec 26, 2024
a82544f
Add Google policies
maxvp Dec 26, 2024
57e2088
Merge branch 'production' into max/gw/api-http-policies
maxvp Dec 26, 2024
a5cd0fa
Update src/content/docs/cloudflare-one/policies/gateway/dns-policies/…
maxvp Dec 26, 2024
089e7bf
Change hyphen to underscore for variable
maxvp Dec 26, 2024
7d12b72
Update src/content/docs/cloudflare-one/policies/browser-isolation/iso…
maxvp Dec 27, 2024
0b0434e
Update command styling
maxvp Dec 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
175 changes: 153 additions & 22 deletions src/content/docs/cloudflare-one/policies/browser-isolation/isolation-policies.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,9 @@ pcx_content_type: reference
title: Isolation policies
sidebar:
order: 2

---

import { Render } from "~/components"
import { Render, Tabs, TabItem } from "~/components";

With Browser Isolation, you can define policies to dynamically isolate websites based on identity, security threats, or content.

Expand All @@ -28,12 +27,10 @@ If instead you need to isolate specific pages, you can list the domains for whic

:::note[Isolate identity providers for applications]


Existing cookies and sessions from non-isolated browsing are not sent to the remote browser. Websites that implement single sign-on using third-party cookies will also need to be isolated.

For example, if `example.com` authenticates using Google Workspace, you will also need to isolate the top level [Google Workspace URLs](https://support.google.com/a/answer/9012184).


:::

## Do Not Isolate
Expand All @@ -46,7 +43,7 @@ You can choose to disable isolation for certain destinations or categories. The

## Policy settings

The following optional settings appear in the Gateway HTTP policy builder when you select the *Isolate* action. Enable these settings to [prevent data loss](https://blog.cloudflare.com/data-protection-browser/) when users interact with untrusted websites in the remote browser.
The following optional settings appear in the Gateway HTTP policy builder when you select the _Isolate_ action. Enable these settings to [prevent data loss](https://blog.cloudflare.com/data-protection-browser/) when users interact with untrusted websites in the remote browser.

### Disable copy / paste

Expand All @@ -62,7 +59,7 @@ Prohibits users from performing keyboard input into the remote web page.

:::note

Mouse input remains available (to allow users to browse a website by following hyperlinks and scrolling). This does not prevent user input into third-party virtual keyboards within a remote web page.
Mouse input remains available (to allow users to browse a website by following hyperlinks and scrolling). This does not prevent user input into third-party virtual keyboards within a remote web page.
:::

### Disable upload
Expand All @@ -71,7 +68,7 @@ Prohibits users from uploading files from their local machine into a remote web

:::note

This option does not prevent files being uploaded to websites from third-party cloud file managers or files downloaded into the remote browser download bar from other isolated websites. To prevent files being uploaded from the remote browser into an isolated website, use HTTP Policies to block by [Upload Mime Type](/cloudflare-one/policies/gateway/http-policies/#download-and-upload-mime-type).
This option does not prevent files being uploaded to websites from third-party cloud file managers or files downloaded into the remote browser download bar from other isolated websites. To prevent files being uploaded from the remote browser into an isolated website, use HTTP Policies to block by [Upload Mime Type](/cloudflare-one/policies/gateway/http-policies/#download-and-upload-mime-type).
:::

### Disable download
Expand All @@ -80,7 +77,7 @@ Prohibits users from exporting files from the remote browser to their local mach

:::note

This option does not prevent files from being downloaded into the remote browser. To prevent files being downloaded into the remote browser, use HTTP Policies to block by [Download Mime Type](/cloudflare-one/policies/gateway/http-policies/#download-and-upload-mime-type).
This option does not prevent files from being downloaded into the remote browser. To prevent files being downloaded into the remote browser, use HTTP Policies to block by [Download Mime Type](/cloudflare-one/policies/gateway/http-policies/#download-and-upload-mime-type).
:::

### Disable clipboard redirection
Expand All @@ -91,7 +88,7 @@ Prevents copying isolated content from the remote browser to their local clipboa

This option does not prevent clipboard interactions between isolated websites. Use [Disable copy / paste](/cloudflare-one/policies/browser-isolation/isolation-policies/#disable-copy--paste) to prohibit clipboard use on sensitive isolated applications.

Disable copy / paste and Disable clipboard redirection are mutually exclusive and cannot be used in conjunction with each other.
Disable copy / paste and Disable clipboard redirection are mutually exclusive and cannot be used in conjunction with each other.
:::

## Common policies
Expand All @@ -100,36 +97,170 @@ Disable copy / paste and Disable clipboard redirection are mutually exclusive an

Isolate security threats such as malware and phishing.

| Selector | Operator | Value | Action |
| -------------- | -------- | ------------------ | ------- |
| Security Risks | in | All security risks | Isolate |
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

| Selector | Operator | Value | Action |
| ------------------- | -------- | -------------------- | ------- |
| Security Categories | in | _All security risks_ | Isolate |

</TabItem>

<TabItem label="API">

```sh
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
"name": "Isolate all security threats",
"description": "Isolate security threats such as malware and phishing",
"enabled": true,
"action": "isolate",
"filters": [
"http"
],
"traffic": "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})",
"identity": "",
"device_posture": ""
}'
```

</TabItem> </Tabs>

### Isolate high risk content

Isolate high risk content categories such as newly registered domains.

| Selector | Operator | Value | Action |
| ------------------ | -------- | -------------- | ------- |
| Content categories | in | Security Risks | Isolate |
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

| Selector | Operator | Value | Action |
| ------------------ | -------- | ---------------- | ------- |
| Content Categories | in | _Security Risks_ | Isolate |

</TabItem>

<TabItem label="API">

```sh
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
"name": "Isolate high risk content",
"description": "Isolate high risk content categories such as newly registered domains",
"enabled": true,
"action": "isolate",
"filters": [
"http"
],
"traffic": "any(http.request.uri.content_category[*] in {32 169 177 128})",
"identity": "",
"device_posture": ""
}'
```

</TabItem> </Tabs>

### Isolate news and media

Isolate news and media sites, which are targets for malvertising attacks.

| Selector | Operator | Value | Action |
| ------------------ | -------- | -------------- | ------- |
| Content categories | in | News and Media | Isolate |
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

| Selector | Operator | Value | Action |
| ------------------ | -------- | ---------------- | ------- |
| Content Categories | in | _News and Media_ | Isolate |

</TabItem>

<TabItem label="API">

```sh
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
"name": "Isolate news and media",
"description": "Isolate news and media sites, which are targets for malvertising attacks",
"enabled": true,
"action": "isolate",
"filters": [
"http"
],
"traffic": "any(http.request.uri.content_category[*] in {122})",
"identity": "",
"device_posture": ""
}'
```

</TabItem> </Tabs>

### Isolate uncategorized content

Isolate content that has not been categorized by [Cloudflare Radar](/radar/).

| Selector | Operator | Value | Action |
| ------------------ | -------- | ---------------------- | ------- |
| Content categories | not in | All content categories | Isolate |
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

| Selector | Operator | Value | Action |
| ------------------ | -------- | ------------------------ | ------- |
| Content Categories | not in | _All content categories_ | Isolate |

</TabItem>

<TabItem label="API">

```sh
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
"name": "Isolate uncategorized content",
"description": "Isolate content not categorized by Cloudflare Radar",
"enabled": true,
"action": "isolate",
"filters": [
"http"
],
"traffic": "not(any(http.request.uri.content_category[*] in {2 67 125 133 3 75 183 89 182 6 90 91 144 150 7 70 74 76 79 92 96 100 106 107 116 120 121 122 127 139 156 164 99 9 101 137 10 103 146 11 12 77 98 108 110 111 118 126 129 172 168 113 33 179 166 15 115 119 124 141 161 17 85 87 102 157 135 138 180 162 140 142 32 169 177 128 22 73 82 88 148 23 24 181 71 72 173 78 84 86 94 97 104 105 114 174 93 130 132 136 147 149 154 158 152 26 69 184 81 95 109 123 145 155 159 160 163 165 167}))",
"identity": "",
"device_posture": ""
}'
```

</TabItem> </Tabs>

### Isolate ChatGPT

Isolate the use of ChatGPT.

<Render file="gateway/policies/isolate-chatgpt" />
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

| Selector | Operator | Value | Action |
| ----------- | -------- | --------- | ------- |
| Application | in | _ChatGPT_ | Isolate |

In **Configure policy settings**, you can customize restrictions for ChatGPT. For example, to prevent your users from inputting sensitive information, you can select **Disable copy / paste** and **Disable file uploads**.

</TabItem>

<TabItem label="API">

```sh
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
"name": "Isolate ChatGPT",
"description": "Isolate the use of ChatGPT",
"enabled": true,
"action": "isolate",
"filters": [
"http"
],
"traffic": "any(app.ids[*] in {1199})",
"identity": "",
"device_posture": ""
}'
```

</TabItem> </Tabs>
2 changes: 2 additions & 0 deletions ...s/cloudflare-one/policies/data-loss-prevention/dlp-policies/common-policies.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ The **Allow** action functions as an implicit logger, providing visibility into
| DLP Profile | in | _Financial Information_ | And | Allow |
| Content Categories | in | _File Sharing_ | | |

## Block file types

<Render file="gateway/policies/block-file-types" />

For more information on what file formats DLP can scan, refer to [Supported file types](/cloudflare-one/policies/data-loss-prevention/#supported-file-types).
Expand Down
6 changes: 6 additions & 0 deletions src/content/docs/cloudflare-one/policies/gateway/dns-policies/common-policies.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,6 +248,8 @@ curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
}'
```

To get the UUIDs of your lists, use the [List Zero Trust lists](/api/resources/zero_trust/subresources/gateway/subresources/lists/methods/list/) endpoint.

</TabItem> </Tabs>

## Block online tracking
Expand Down Expand Up @@ -281,6 +283,8 @@ curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
}'
```

To get the UUIDs of your lists, use the [List Zero Trust lists](/api/resources/zero_trust/subresources/gateway/subresources/lists/methods/list/) endpoint.

</TabItem> </Tabs>

## Block malicious IPs
Expand Down Expand Up @@ -314,6 +318,8 @@ curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule\
}'
```

To get the UUIDs of your lists, use the [List Zero Trust lists](/api/resources/zero_trust/subresources/gateway/subresources/lists/methods/list/) endpoint.

</TabItem> </Tabs>

## Turn on CIPA filter
Expand Down
Loading
Loading