Configure HTTP Header Injection for specific URL patterns

This policy lets you define rules that inject custom HTTP headers into web requests matching specific URL patterns. Headers injected by this policy take precedence over headers already present in the request and over modifications made by users or extensions.

A common use case for this policy is enforcing tenant access controls by injecting custom headers (for example, X-Tenant-ID).

The policy accepts a list of Rules. Each Rule contains:

* patterns: A list of URL patterns to match. For information about URL pattern format, see https://go.microsoft.com/fwlink/?linkid=2095322.

* headers: A list of header objects to inject. Each object contains:

* name: The name of the header to inject.

* value: The value of the header to inject.

If multiple rules match a request, headers from all matching rules are applied. If multiple matching rules specify the same header name, the header from the most specific URL pattern is applied. If multiple matching patterns are equally specific, the header from the rule that appears last in the list is applied.

Header names must comply with RFC 2616 (https://www.rfc-editor.org/rfc/rfc2616). Header values must not contain NUL, CR, or LF characters. Individual headers can't exceed 8 KB. Invalid headers and URL patterns are ignored.

This policy supports a maximum of 500 URL patterns across all rules. Each rule can contain up to 20 headers. URL patterns and headers that exceed these limits are ignored.

Example value:

[
{
"patterns": [
"example.com",
".example.org"
],
"headers": [
{
"name": "X-Tenant-ID",
"value": "123456"
},
{
"name": "X-Custom-Header",
"value": "CustomValue"
}
]
}
]