Google Cloud Secure Web Proxy: Routing Modes and Access Policies
Distinguish explicit and next-hop routing, then match the required HTTP destination or request fields with the selected policy surface.
Secure Web Proxy can apply managed destination policy to outbound HTTP and HTTPS traffic routed through it. Creating the gateway alone does not put workloads on that route.
| Routing mode | How traffic reaches it |
|---|---|
| Explicit | Participating workload HTTP clients use the proxy endpoint |
| Next hop | Network routing directs traffic to the service |
For gateway security policies, session matching can evaluate source identity, destination hostname and port. Application-level matching adds URL paths, methods and headers; inspecting encrypted request content requires the corresponding TLS inspection arrangement.
Rules use lower-numbered priorities first, with the first match determining the action. The gateway security policy defaults to denying traffic until an allow rule permits it.
Choose the policy surface with its features in view. A gateway uses either an authorization policy or a gateway security policy; they do not expose identical match features. URL lists belong to gateway security policies.
The documented service supports IPv4 and HTTP through HTTP/2, without IPv6 or HTTP/3. Those limits, and any non-web TCP requirement, belong in the routing choice before adopting it for the workload.