Configure Browser Access with URL Rewrite

URL rewrite for Browser Access (BA) automatically rewrites server-side HTTP 30x redirect responses returned in the Location: header. This rewrites the Location: header to use the Custom Hostname (if configured) or the default Netskope public host FQDN, even when backend applications redirect to internal IPs or hostnames that are unreachable from the user’s network.

How URL Rewrite Works

When the Browser Access gateway receives an HTTP response with a 30x status code and a Location: header pointing to an internal address, it rewrites that Location value to use the Custom Hostname (if configured), or the default Netskope public host FQDN, before forwarding the response to the user’s browser. The original path and query parameters are preserved.

Stage	URL Example
User accesses BA application	https://192-168-1-100-443-tenant.npaproxy.goskope.com/
Backend issues redirect to internal IP	Location: https://192.168.1.100/dashboard
BA gateway rewrites the Location header	Location: https://192-168-1-100-443-tenant.npaproxy.goskope.com/dashboard
User’s browser follows rewritten URL	Session continues — path preserved, no internal address exposed

URL rewrite is applied automatically for all Browser Access traffic. Follow these steps to set up a Browser Access application:

1. In the Netskope tenant, go to go to Settings > Security Cloud Platform > App Definition and click Private App Segments.
2. Create a new App Definition for a Browser Access application, or edit an existing one.
3. Configure the internal application host and port (for example, set the internal host to the application’s IP address or hostname, port 80).
   
4. Save the configuration and allow the changes to propagate to Browser Access gateways.

Considerations

• URL rewrite applies only to server-side HTTP 30x redirects (excluding 300 Multiple Choices) in Location: response headers.
• URL rewrite applies only to redirects whose target host and port match the destination host and port configured in the Browser Access app segment. Cross-domain or cross-port redirects are not rewritten.
• URL rewrite does not rewrite href attributes or URLs embedded in the HTML response body.
• JavaScript-based redirects are not intercepted by URL rewrite.

URL Rewrite Verification

1. Access the Browser Access application from an end-user browser.
2. Complete authentication. If the backend application issues a server-side redirect, observe the browser address bar.
3. Confirm that the URL shows the Custom Hostname (if configured) or the default Netskope public host FQDN, with the correct application path preserved.
4. Navigate through the application to confirm subsequent redirects also preserve the expected hostname and path.

Troubleshooting

Symptom	Resolution
Browser redirects to an internal IP instead of the Browser Access hostname	Confirm Browser Access is enabled and the application configuration has propagated to gateways. Test with a direct Browser Access URL to verify baseline connectivity.
Path or query parameters are missing after redirect	Confirm the redirect is a server-side HTTP 30x redirect via the Location: header. JavaScript-based redirects are not supported by URL rewrite.
Redirect to a different domain still breaks the session	Cross-domain redirects are outside the scope of URL rewrite. The redirect target host and port must match the destination host and port configured in the Browser Access app segment.

Related Topics

• Enabling URL Rewrites, Custom Hostname and Portal Links for NPA Browser Access
• Configure a Custom Hostname
• Configure Portal Links
• Netskope Private Access Overview