Training
Module
Protect against malicious attacks and unauthorized access with Microsoft Edge - Training
Protect against malicious attacks and unauthorized access with Microsoft Edge
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
This article describes the filter format used for the Microsoft Edge URL list-based policies For example, URLBlocklist, URLAllowList, and CertificateTransparencyEnforcementDisabledForUrls policies.
The filter format is:
[scheme://][.]host[:port][/path][@query]
The fields in the filter format are:
Field | Description |
---|---|
scheme (optional) | It can be http://, https://, ftp://, edge://, etc. |
host (required) | It must be a valid host name and you can use a wildcard ("*"). To disable subdomain matching, include an optional dot (.) before host. A single IP Address Literal hostname may be specified, but wildcarding isn't supported for an IP Address Literal hostname. |
port (optional) | Valid values range from 1 to 65535. |
path (optional) | You can use any string in the path. |
query (optional) | The query is either key-value or key-only tokens separated by an ampersand ("&"). Separate key-value tokens with an equal sign ("="). To indicate a prefix match, you can use an asterisk ("*") at the end of the query. |
The filter format resembles the URL format, except for the following differences:
The filter selected for a URL is the most specific match found after processing the following filter selection rules:
Filters with the longest host match are selected first.
From the selected filters, any filter with a scheme or port that doesn't match is discarded.
From the remaining filters, the filter with the longest matching path is selected.
From the remaining filters, the filter with the longest set of query tokens is selected. At this step, the allowlist filter takes precedence over the blocklist filter if both filters have the same path length and number of query tokens.
If there's no valid filter remaining, then the left-most subdomain is removed from host and the selection process starts over at step 1. The special asterisk ("*") host is the last searched and it matches all hosts.
If a filter's available, it blocks or allows the URL request.
Note
The default behavior is to allow the URL request if no filter is matched.
In this example, when searching for a match to "https://sub.contoso.com/docs" the filter selection will:
sub.contoso.com
. If it finds a filter, the search moves to step 2. If a filter isn't found, then it tries again with contoso.com
, com
, and finally " ".If a filter has a dot (".") prefixing the host then only exact host matches are filtered. For example:
contoso.com
(no dot) matches contoso.com
, www.contoso.com
, and sub.www.contoso.com
.www.contoso.com
(with a dot prefix) only matches www.contoso.com
You can use either a standard or custom schema. Supported standard schemas include:
Any other schema is treated as a custom schema, but only the schema:* and schema://* patterns are allowed. For example:
schema and host aren't case-sensitive. For example:
http://contoso.com
filter matches HTTP://contoso.com
, http://contoso.COM
, and http://contoso.com
path and query are case-sensitive. For example:
http://contoso.com/path?query=A
filter doesn't match http://contoso.com/Path?query=A
or http://contoso.com/path?Query=A
. It does match http://contoso.COM/path?query=A
.Note
Portions of this page are modifications based on work created and shared by Chromium.org and used according to terms described in the Creative Commons Attribution 4.0 International License. The original Chromium page can be found here.
This work is licensed under a Creative Commons Attribution 4.0 International License.
Training
Module
Protect against malicious attacks and unauthorized access with Microsoft Edge - Training
Protect against malicious attacks and unauthorized access with Microsoft Edge