HttpHeaderInjection

Configure HTTP Header Injection for specific URL patterns

Supported versions

  • Windows: ≥ 153
  • macOS: ≥ 153
  • Android: Not supported
  • iOS: Not supported

Description

This policy lets you define rules that inject custom HTTP headers into web requests matching specific URL patterns. Headers injected by this policy take precedence over headers already present in the request and over modifications made by users or extensions.

A common use case for this policy is enforcing tenant access controls by injecting custom headers (for example, X-Tenant-ID).

The policy accepts a list of Rules. Each Rule contains:

  • patterns: A list of URL patterns to match. For information about URL pattern format, see https://go.microsoft.com/fwlink/?linkid=2095322.

  • headers: A list of header objects to inject. Each object contains:

  • name: The name of the header to inject.

  • value: The value of the header to inject.

If multiple rules match a request, headers from all matching rules are applied. If multiple matching rules specify the same header name, the header from the most specific URL pattern is applied. If multiple matching patterns are equally specific, the header from the rule that appears last in the list is applied.

Header names must comply with RFC 2616 (https://www.rfc-editor.org/rfc/rfc2616). Header values must not contain NUL, CR, or LF characters. Individual headers can't exceed 8 KB. Invalid headers and URL patterns are ignored.

This policy supports a maximum of 500 URL patterns across all rules. Each rule can contain up to 20 headers. URL patterns and headers that exceed these limits are ignored.

Supported features

  • Can be mandatory: Yes
  • Can be recommended: No
  • Dynamic Policy Refresh: Yes
  • Per Profile: Yes
  • Applies to a profile that is signed in with a Microsoft account: No

Data type

  • Dictionary

Windows information and settings

Group Policy (ADMX) info

  • GP unique name: HttpHeaderInjection
  • GP name: Configure HTTP Header Injection for specific URL patterns
  • GP path (Mandatory): Administrative Templates/Microsoft Edge/Network settings
  • GP path (Recommended): N/A
  • GP ADMX file name: MSEdge.admx

Example value

[{"headers": [{"name": "X-Tenant-ID", "value": "123456"}, {"name": "X-Custom-Header", "value": "CustomValue"}], "patterns": ["example.com", ".example.org"]}]

Registry settings

  • Path (Mandatory): SOFTWARE\Policies\Microsoft\Edge
  • Path (Recommended): N/A
  • Value name: HttpHeaderInjection
  • Value type: REG_SZ

Example registry value

[{"headers": [{"name": "X-Tenant-ID", "value": "123456"}, {"name": "X-Custom-Header", "value": "CustomValue"}], "patterns": ["example.com", ".example.org"]}]

Expanded example registry value

[
  {
    "headers": [
      {
        "name": "X-Tenant-ID",
        "value": "123456"
      },
      {
        "name": "X-Custom-Header",
        "value": "CustomValue"
      }
    ],
    "patterns": [
      "example.com",
      ".example.org"
    ]
  }
]

Mac information and settings

  • Preference Key name: HttpHeaderInjection
  • Example value:
<key>HttpHeaderInjection</key>
<array>
  <dict>
    <key>headers</key>
    <array>
      <dict>
        <key>name</key>
        <string>X-Tenant-ID</string>
        <key>value</key>
        <string>123456</string>
      </dict>
      <dict>
        <key>name</key>
        <string>X-Custom-Header</string>
        <key>value</key>
        <string>CustomValue</string>
      </dict>
    </array>
    <key>patterns</key>
    <array>
      <string>example.com</string>
      <string>.example.org</string>
    </array>
  </dict>
</array>

See also

  • Last updated on