The Cisco Web Security Appliance (WSA) uses the Referer field within the HTTP request header to implement referrer exceptions. This header field indicates the URL of the web page from which the requested resource was linked. By inspecting this header, the WSA can create policy exceptions, for example, to allow access to embedded content from a specific trusted website while blocking direct access to that same content. The feature relies entirely on parsing this specific header information.

A. protocol: The protocol (e.g., HTTP, HTTPS) defines the communication standard but does not contain the referring URL.

B. version: The HTTP version (e.g., HTTP/1.1) specifies the syntax and rules of the protocol, not the origin of the request.

D. payload: The payload, or body, of an HTTP request contains data being sent to the server (e.g., form data) and does not include the Referer information.

1. Cisco. (2017). Cisco Web Security Appliance Best Practices Guide. Document ID: 118916. In the section "Creating a Custom URL Category for Referrer Header Exceptions

" the guide states

"This custom URL category will contain a regular expression that will match on the HTTP Referer Header of the request."

2. Cisco. (2023). AsyncOS 15.0 for Cisco Web Security Appliances User Guide. In the chapter "Access Policies

" the section "Creating Custom URL Categories to Use in Policies" describes how to define URL categories by matching transaction elements

including the "Referer Header." This confirms that the header is the source of information for this feature.