Netskope Private Access (NPA) Browser Access supports URL Rewrite, Custom Hostname, and Portal Links to ensure that external user flows consistently use your intended external hostname and preserve application paths. These capabilities address scenarios where backend applications perform server-side redirects that would otherwise send users to unreachable internal addresses or drop URL paths.
URL Rewrite: Browser Access automatically rewrites server-side HTTP 30x redirect responses (excluding 300 Multiple Choices redirection response) returned in the Location: header. If a Custom Hostname is configured for the application, the Location header is rewritten to use the custom hostname; otherwise, it is rewritten to use the default Netskope public host FQDN. Path and query parameters are preserved.
Custom Hostname: Allows you to present a stable, branded external hostname to users when they launch Browser Access applications from the portal, instead of the default tenant-generated hostname.
Portal Links: Enable deep links for Browser Access and Enterprise Browser applications that preserve full URL paths. Portal Links control the initial launch URL from the portal and the post-authentication return-to-path, ensuring users land on the correct application path after identity provider authentication.
Note
These capabilities can be used independently. URL rewrite is applied automatically and does not require Portal Links or Custom Hostname to function.
| Capability | Description |
|---|---|
| URL Rewrite | Automatically rewrites server-side HTTP 30x redirects in the Location: header to use the Custom Hostname (if configured) or the default Netskope public host FQDN, preserving path and query parameters. |
| Custom Hostname | Replaces the auto-generated tenant hostname with a stable, branded FQDN for Browser Access portal tiles and launched sessions. |
| Portal Link | Publishes full-path deep links in the Browser Access or Enterprise Browser portal. Controls the initial launch URL and post-authentication return-to-path. |
Prerequisites
Before configuring these features, ensure the following:
- Your tenant is licensed for Netskope Private Access with Browser Access enabled.
- At least one Browser Access or Enterprise Browser application is onboarded and accessible via NPA.
- The target application performs HTTP/HTTPS redirects after user authentication, or exposes a non-root path that should be preserved.
- The Browser Access portal is enabled if you plan to use Portal Links or portal tiles.
- You have administrative access to the Netskope admin console with permissions to manage NPA applications, Browser Access, and portal configuration.
Considerations
- URL rewrite applies only to server-side HTTP 30x redirects (excluding 300 Multiple Choices redirection response) in HTTP response headers (
Location:). - The backend application’s absolute redirect host and port must match the destination host and port configured in the Browser Access app segment.
- URL rewrite applies only to redirects whose target host and port match the destination host and port configured in the Browser Access app segment. Cross-domain or cross-port redirects are not rewritten.
- URL rewrite does not rewrite URLs embedded in the HTTP response body (like
hrefattributes in HTML) or redirects implemented in JavaScript. - Portal Links support HTTP and HTTPS Browser Access flows only.
- If using Custom Hostname, DNS for the custom hostname must resolve to the Netskope Browser Access proxy, and valid TLS certificates must be configured for the chosen hostname.