URL Patterns

URL patterns tell the Netskope DEM browser extension which web applications to monitor. Getting them right is the single most important setup step, and the most common source of why am I not seeing data? questions. This guide covers how patterns work, exact syntax, real‑world SPA and MPA examples, and every corner case.

Read this first — the one concept that prevents most mistakes: A URL pattern matches the page (the top‑level navigation). After a page is monitored, the extension automatically captures everything that page loads: all API calls, all resources (JS, CSS, images, fonts), and all cross‑origin requests, including assets served from CDNs or cloud storage such as Amazon S3. You do not list CDN, API, or storage hosts in your patterns; you list the pages of your app, and their traffic follows automatically.

How Capture Actually Works

There are two stages, and confusing them is the root of most configuration errors.

Stage 1: Patterns select the Page

When a tab navigates to a new document, the extension checks the page URL against your app’s urlPatterns (and urlExclusions). If a pattern matches, monitoring starts for that page.

Stage 2: All of the page’s traffic is captured automatically

After a page is monitored, the extension records every request it makes (via the browser’s W3C Resource Timing API):

• The page navigation itself
• Every resource: JavaScript, CSS, images, fonts, media
• Every API call: fetch, XMLHttpRequest, beacon
• Regardless of host: your origin, a CDN, an API subdomain, a third party, or Amazon S3 / Azure Blob storage

The only things that remove traffic are your urlExclusions and a built‑in filter that ignores non‑http(s) requests.

Takeaway: Configure patterns for the pages users visit, not the assets those pages load. If your UI lives at https://app.contoso.com/*, but pulls data from api.contoso.com, and files from S3, the single pattern https://app.contoso.com/* captures all three.

When do you need a pattern for another host? Only when that host is opened as its own top‑level page, like a file that opens in its own tab, an auth page on another domain you want monitored, or a separate sub‑app on another domain.

Pattern Format

<scheme>://<host>[:port][/path]

Scheme

One of: http, https, ws, wss, or *.

• * matches any of the four.
• The scheme determines the default port.
• Practical guidance: Use https, or * to be scheme‑agnostic. ws/wss are accepted, but WebSocket traffic is not recorded (RUM is HTTP‑based).

Host

Case‑insensitive. ASCII letters, digits, hyphen, dot, and the wildcard *. IPv6 supported in brackets, like [fe80::7d15:f81e:c9c7:d2d9].

• * matches any run of characters, including dots:
  *.contoso.com matches mail.contoso.com and a.b.contoso.com.
• ⚠️ *.contoso.com does not match the apex contoso.com. Add contoso.com too.
• A non‑wildcard host matches exactly — contoso.com is not its subdomains.

Port

• Omitted: the URL must use the scheme’s standard port (80 for http/ws, 443 for https/wss). A pattern with no port will not match a non‑standard port.
• :* → any port.
• :<number> → that exact port.

Path

• Omitted/empty → matches all paths (same as /*).
• Starts with /; may contain *; no ? or #.
• Matching is exact — a full match of the whole path, not a prefix. /path matches only /path, not /path/ or /path/x. Use * to extend.
• Consecutive slashes collapse to one (/a///b → /a/b).
• Matched against the URL path only — query (?…) and fragment (#…) are stripped first.

Not allowed in a pattern

• Query strings. A pattern with ? is rejected. (Matching still ignores a URL’s query, so a presigned S3 URL like …/file?X-Amz-Signature=… matches on its path.)
• A literal *. * is always a wildcard.
• Non‑ASCII. Use punycode for IDNs: www.café.fr → www.xn--caf-dma.fr (regular hyphen -).
• No percent‑decoding.  https://contoso.com/test/* does not match https://contoso.com/t%65st.

Golden Rules Top Mistakes

Real‑world Examples

Here are four types of real-world examples: Single Page Applications, Multi-Page Applications, Apps that use AWS S3 (or other cloud storage), and a typical internal app.

Single Page Applications (SPA)

SPAs load once, then change view via client‑side routing (the path or #fragment changes without a full navigation). The extension matches the initial navigation, so you match the host, not in‑app routes, and you can’t target a #fragment route anyway. The app’s API calls and CDN/storage assets are captured automatically.

Multi‑Page Applications (MPA)

MPAs perform a real navigation for most actions, loading many distinct page URLs. Each navigation is rechecked, so a single host‑level /* covers them; add subdomain/port wildcards if the app spans several.

Apps that use Amazon S3 (or other cloud storage)

You almost never need an S3 pattern. Two cases:

1. S3 as backend storage for assets/uploads/downloads loaded by your pages → no pattern needed: Captured as resources/API of the monitored page. Presigned URLs match fine (query ignored).
2. S3 objects opened directly as their own tab: add a pattern matching the URL style you use:https://*.s3.amazonaws.com/* https://s3.amazonaws.com/* https://*.s3.*.amazonaws.com/* # regional, e.g. bucket.s3.us-east-2.amazonaws.com

A typical Internal App

UI at https://app.contoso.com, REST API at https://api.contoso.com, files in S3, HTTPS‑only:

https://app.contoso.com/*

That’s it. The api.contoso.com calls and S3 loads are captured automatically because they’re made by the monitored pages. Add an S3 pattern only if users open bucket URLs as standalone tabs; add https://api.contoso.com/* only if users open the API host directly.

Pattern Matching Examples

Verified against the extension’s matching engine. Each row may list several equivalent patterns.

Corner Cases & FAQs

Path matching is exact, not “starts with.” 
…/reports matches only that page, not …/reports/ or …/reports/2024. Use …/reports/*, …/reports*, or …/* for the whole app.

Trailing slash matters 
/path ≠ /path/. A bare host (https://app.contoso.com) matches all paths — the simplest “whole app” pattern.

The wildcard host spans dots.  *.contoso.* matches mail.contoso.com, mail.contoso.co.uk, smtp.contoso.other.com. Powerful but easy to over‑scope.

*.host.com excludes the apex. 
Add a separate host.com pattern for the root domain.

No port = default port only. 
https://app.contoso.com/* won’t match :8443. Use :*.

Query strings can’t go in a pattern and don’t affect matching. 
Why presigned S3 / signed CDN URLs still match a path pattern.

Fragments (#…) are ignored. 
You can’t target an SPA hash route (…/#inbox) — match the host.

Resources are captured by the page, not by patterns. 
A monitored page’s CDN/API/S3 traffic is captured even though those hosts aren’t listed. Adding a CDN host as a pattern captures nothing unless users open it as a top‑level page.

Over‑broad patterns capture everything. 
*://*/* monitors every site — volume and privacy concern. Scope to your apps.

WebSockets aren’t recorded
Even with a */ws/wss scheme (RUM is HTTP Resource Timing based).

IDNs need punycode.
 café.fr → xn--caf-dma.fr; münchen.de → xn--mnchen-3ya.de.

Cross‑origin timing detail depends on the server. 
A cross‑origin resource is always counted, but detailed sub‑timings require a Timing-Allow-Origin response header. Missing it means the resource still appears with limited timing — a server header, not a pattern setting.

urlExclusions remove traffic from a monitored page. 
Same syntax; use to drop noisy hosts/paths (analytics, telemetry). Exclusions only remove — never add capture.

Quick Troubleshooting Checklist

IDN host not matching? 
Convert to punycode.

No data at all? 
Confirm a pattern matches the page URL the user lands on (path‑exactness, apex‑vs‑subdomain). Try the bare‑host …/* form first.

Only the landing page, not the rest? 
You pinned a path; switch /page to /* (or /section/*).

Works on app.contoso.com but not contoso.com? 
Add the apex pattern.

Nothing on a non‑standard port? 
Add :*.

Missing a sub‑app on another domain? 
It loads as its own page; add a pattern.

CDN/S3/API requests “missing”? 
They’re attributed to their parent page; open the monitored page’s detail, not a standalone host.