If, dear reader, you ever wanted to see HTTP headers in forwarded traffic through a FortiGate or how to view decrypted traffic without having to mirror it to an external device, have I got some tips for you.
Models and versions:
- FortiGate 70G on 7.6.7
- Ubuntu server on 24.04
See HTTP headers in FortiGate forwarded traffic
For troubleshooting purposes, it can help to see what HTTP headers are being sent to a host. In my case, I needed to find out what an incoming HTTP POST request looked like to fix my backend configuration.
In order to facilitate this, you need a proxy-based firewall policy that uses some security profile other than the SSL/SSH profile (just the SSL/SSH profile alone means no inspection is performed), because we need the traffic to hit the wad process, and if your traffic is HTTPS, you need deep inspection as well. The type of security profile doesn’t actually matter. I have tested anti-virus, web filter, DNS filter, application control, IPS, file filter, and web application firewall, and all of them worked. For my security profile, I am using a Web Application Firewall (WAF) profile because it requires the least amount of CLI configuration and a deep inspection SSL/SSH profile.
config waf profile
edit "WAF_HTTP-HEADERS"
next
endWith the WAF profile created and your deep inspection set up, if necessary, you can create a proxy-based policy with both profiles configured. Remember that you need “Web Application Firewall” enabled in Feature Visibility to see the GUI option.
Only important parts are shown!
config firewall policy
edit 0
set name "HTTP-HEADERS-POLICY"
set utm-status enable
set inspection-mode proxy
set ssl-ssh-profile "custom-deep-inspection"
set waf-profile "WAF_HTTP-HEADERS"
next
endBecause proxy-based web inspection uses the wad process, we need the debugs for the wad category http enabled and a level of info. Once our traffic happens, the debugs will fill up quickly.
diagnose wad debug enable category http
diagnose wad debug enable level info
diagnose debug enableI am using the following curl command to a webhook.site endpoint:
curl -X POST -H 'Authorization: Bearer TESTTOKEN' -H 'Content-type: application/json' -d '{"name":"Kevin Guenay"}' https://webhook.site/6z7993e7-4679-4003-b4f1-18f72b628fe1The full debug of the request is as follows:
WAD debug output
[I][p:1760][s:3147] wad_url_cate_dump_req_ctx :327 (fetch-done): req/wfp=0/0 cate: cate=255 webf=255 sslexempt=255 url/ip=255/255 don
e: bal=0,local/user/cache/ftgd=1/1/1/1 matched[url]: block/allow/user=0/0/0 ftgd=0 sub=1 log=0 invalid=0
[I][p:1760][s:3147] wad_url_choose_cate :2504 cate=52 (ftgd) url-cates=[52,]; url=[ # 52,],ip=[ # 0,]; conf sslexempt_rating :[33,31,]
[I][p:1760][s:3147] wad_http_srv_selector_static_make :1956 make static server selector.
[I][p:1760][s:3147] wad_http_srv_slct_static_set_connectable:1127 static server selector connectable set to 0.
[I][p:1760][s:3147] wad_http_srv_slct_static_set_connectable:1127 static server selector connectable set to 0.
[I][p:1760][s:3147] wad_http_full_ses_make :15978 hs(0x7f7e8b91f0) switch to H2.
[I][p:1760][s:3147] wad_http_full_ses_make :16013 make ok session=0x7f8983fa28 server=0x7f814882a8.
[I][p:1760][s:3147][r:50331677] wad_dump_http_request :3134 hreq=0x7f7eb63700 Received request from client: 192.168.1.151:53566
POST /6z7993e7-4679-4003-b4f1-18f72b628fe1 HTTP/2.0
Host: webhook.site
user-agent: curl/8.5.0
accept: */*
content-type: application/json
content-length: 23
[I][p:1760][s:3147][r:50331677] wad_http_parse_host :2019 host=[12]webhook.site
[I][p:1760][s:3147][r:50331677] wad_http_str_canonicalize :2621 enc=0 path=/6z7993e7-4679-4003-b4f1-18f72b628fe1 len=37 changes=0
[I][p:1760][s:3147][r:50331677] wad_http_req_detect_special :14589 captive_portal detected: false, preflight=(null)
[I][p:1760][s:3147][r:50331677] wad_http_waf_access_control :1242
[I][p:1760][s:3147][r:50331677] wad_http_req_proc_waf_body :1346
[I][p:1760][s:3147][r:50331677] wad_http_req_proc_waf_body :1346
[I][p:1760][s:3147][r:50331677] wad_http_waf_check_req :1205 WAF sanity check msg=0x7f7eb63700 rid=83
[I][p:1760][s:3147][r:50331677] wad_http_srv_attach_req :939 [0x7f7eb63700] Use old server0x7f82fa75d8: :0
[I][p:1760][s:3147][r:50331677] wad_dump_fwd_http_req :3148 hreq=0x7f7eb63700 Forward request to server:
POST /6z7993e7-4679-4003-b4f1-18f72b628fe1 HTTP/2.0
Host: webhook.site
user-agent: curl/8.5.0
accept: */*
authorization: Bearer TESTTOKEN
content-type: application/json
content-length: 23
[I][p:1760][s:3147][r:50331677] wad_dump_http_resp :3163 hreq=0x7f7eb63700 Received response from server:
HTTP/2.0 200 OK
server: nginx
content-type: text/html; charset=UTF-8
x-request-id: 083ca667-b3dd-4597-89b4-c8ec44a29127
x-token-id: 6z7993e7-4679-4003-b4f1-18f72b628fe1
content-security-policy: signup-to-remove-csp-header 'webhook.site/register'; base-uri 'self'; form-action 'none'; script-src 'none'; worker-src 'none'; frame-src 'non
e';
cache-control: no-cache, private
date: Fri, 14 Aug 2026 19:05:21 GMT
[I][p:1760][s:3147][r:50331677] wad_http_fwd_non_cacheable_resp :2630 resp(0x7f7df439f0) starts processing.
[I][p:1760][s:3147][r:50331677] wad_http_resp_setup_fwd_resp :2607 msg(0x7f7df439f0) build fwd resp!
[I][p:1760][s:3147][r:50331677] wad_dump_fwd_http_resp :3155 hreq=0x7f7eb63700 Forward response from Server:
HTTP/2.0 200 OK
server: nginx
content-type: text/html; charset=UTF-8
x-request-id: 083ca667-b3dd-4597-89b4-c8ec44a29127
x-token-id: 6z7993e7-4679-4003-b4f1-18f72b628fe1
content-security-policy: signup-to-remove-csp-header 'webhook.site/register'; base-uri 'self'; form-action 'none'; script-src 'none'; worker-src 'none'; frame-src 'non
e';
cache-control: no-cache, private
date: Fri, 14 Aug 2026 19:05:21 GMT
[I][p:1760][s:3147][r:50331677] wad_http_req_resp_fwd_done :3488 req(0x7f7eb63700) resp(0x7f7df439f0/0x7f7df439f0) resp-fwd done!
[I][p:1760][s:3147][r:50331677] wad_http_req_finished :1607 req=0x7f7eb63700 cstrm=0x7f7e8b9298 req_done=1 done_close=0
[I][p:1760][s:3147][r:50331677] __wad_http_req_close :2071 ret = -1!
[I][p:1760][s:3147] wad_http_srv_free :5196 HTTP server(0x7f82fa75d8) closed.
[I][p:1760][s:3147] wad_http_session_free :14352 http cache session 0x7f7e8b91f0 req=(nil) close
[I][p:1760] __wad_http_session_task_end :14524 wad_http_cstrm_shutdown:15053: hcs=0x7f7e8b91f0 good=0 state=3 processing=1 state=4 processing=1 fre
edIn the debugs, we care about the section after “Forward request to server:”
[I][p:1760][s:3147][r:50331677] wad_dump_fwd_http_req :3148 hreq=0x7f7eb63700 Forward request to server:
POST /6z7993e7-4679-4003-b4f1-18f72b628fe1 HTTP/2.0
Host: webhook.site
user-agent: curl/8.5.0
accept: */*
authorization: Bearer TESTTOKEN
content-type: application/json
content-length: 23We can see the URL path the POST got sent to, the host, and the HTTP headers, including my authorization bearer token. You can do with this information what you need.
View decrypted traffic on a FortiGate without an external device
The decrypted traffic mirror feature on a FortiGate is an interesting one because it allows you to mirror decrypted traffic to another interface, which can then be captured and inspected by a device, like a dedicated intrusion detection system (IDS). Normally, decrypted traffic is not capturable on a FortiGate itself; you only gain visibility for the internal processes that work with this kind of traffic (IPS, anti-virus, etc.), but with decrypted traffic mirroring and some ingenuity, you can capture this traffic without an external device.
Note: The decrypted traffic mirror feature should be used with caution. Handling this type of traffic can be an invasion of privacy, and you need to check your local laws to see if this is allowed in your region if you are handling relevant traffic (health and finance information are the most critical types). You will see a message reminding you that this is something you need to be aware of, both in the GUI and the CLI.
Now that you are aware of the problems, let’s get to configuring.
If you are configuring a policy with an SSL/SSH profile performing deep inspection, you get the “Decrypted traffic mirror” option, and there you can select an existing mirror port or create one inline. I haven’t tested all options, but I think all types of interfaces can be mirror ports, including VLANs and loopbacks. For this post, I am enabling the feature for a VLAN interface. As long as the interface is up, it is valid, so you can create a dummy VLAN interface on a parent port that is up.
config firewall decrypted-traffic-mirror
edit "DTM_VLAN"
set dstmac ff:ff:ff:ff:ff:ff
set traffic-type ssl ssh
set traffic-source both
set interface "VL_TEST"
next
endOnce your policy is configured accordingly, you can capture traffic on it, either in the GUI via Network -> Diagnostics -> Packet capture or on the CLI using diagnose sniffer packet <INTERFACE> ‘<FILTER>’ 6 0 a, e.g. diagnose sniffer packet VL_TEST ‘host 192.168.1.151’ 6 0 a. The 6 is used so the headers and data from packets are captured along with the interface name.
Only important parts are shown!
config firewall policy
edit 0
set name "DTM-POLICY"
set utm-status enable
set inspection-mode proxy
set ssl-ssh-profile "custom-deep-inspection"
set waf-profile "WAF_HTTP-HEADERS"
set decrypted-traffic-mirror "DTM_VLAN"
next
endRemember that you need at least one security profile in a policy performing any form of inspection that isn’t the SSL/SSH profile; otherwise, no inspection happens. That is the reason why the WAF profile that I created in the other accompanying quick tip is there.
If you want to view the traffic in Wireshark and you have performed the capture on the GUI, you can download the PCAP immediately, and if you do it on the CLI, you need to capture and convert the output using a Fortinet-provided tool.
Using my previous curl command, just with the --http1.1 option added, the capture shows the HTTP headers as well as the payload. The --http1.1 option is optional, but without it, not all information may be visible due to possible HTTP/2 compression, which webhook.site uses.
Decrypted traffic mirror CLI capture
2026-08-14 19:31:34.499189 VL_TEST -- 192.168.1.202.46574 -> 178.63.67.153.443: syn 0
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c285 c0a8 01ca b23f .(....@........?
0x0020 4399 b5ee 01bb 0000 0000 0000 0000 5002 C.............P.
0x0030 ffff 3fee 0000 ..?...
2026-08-14 19:31:34.499199 VL_TEST -- 178.63.67.153.443 -> 192.168.1.202.46574: syn 0 ack 1
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c285 b23f 4399 c0a8 .(....@....?C...
0x0020 01ca 01bb b5ee 0000 0000 0000 0001 5012 ..............P.
0x0030 ffff 3fdd 0000 ..?...
2026-08-14 19:31:34.499202 VL_TEST -- 192.168.1.202.46574 -> 178.63.67.153.443: ack 1
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c285 c0a8 01ca b23f .(....@........?
0x0020 4399 b5ee 01bb 0000 0001 0000 0001 5010 C.............P.
0x0030 ffff 3fde 0000 ..?...
2026-08-14 19:31:34.499210 VL_TEST -- 192.168.1.151.46574 -> 178.63.67.153.443: syn 0
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c2b8 c0a8 0197 b23f .(....@........?
0x0020 4399 b5ee 01bb 0000 0000 0000 0000 5002 C.............P.
0x0030 ffff 4021 0000 ..@!..
2026-08-14 19:31:34.499213 VL_TEST -- 178.63.67.153.443 -> 192.168.1.151.46574: syn 0 ack 1
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c2b8 b23f 4399 c0a8 .(....@....?C...
0x0020 0197 01bb b5ee 0000 0000 0000 0001 5012 ..............P.
0x0030 ffff 4010 0000 ..@...
2026-08-14 19:31:34.499215 VL_TEST -- 192.168.1.151.46574 -> 178.63.67.153.443: ack 1
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c2b8 c0a8 0197 b23f .(....@........?
0x0020 4399 b5ee 01bb 0000 0001 0000 0001 5010 C.............P.
0x0030 ffff 4011 0000 ..@...
2026-08-14 19:31:34.524767 VL_TEST -- 192.168.1.151.46574 -> 178.63.67.153.443: 1 ack 1
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0104 0000 0000 4006 c1dc c0a8 0197 b23f ......@........?
0x0020 4399 b5ee 01bb 0000 0001 0000 0001 5010 C.............P.
0x0030 ffff 2917 0000 504f 5354 202f 3366 6139 ..)...POST./6z79
0x0040 3933 6537 2d34 3637 392d 3430 3033 2d62 93e7-4679-4003-b
0x0050 3466 312d 3138 6637 3262 3632 3866 6531 4f1-18f72b628fe1
0x0060 2048 5454 502f 312e 310d 0a48 6f73 743a .HTTP/1.1..Host:
0x0070 2077 6562 686f 6f6b 2e73 6974 650d 0a55 .webhook.site..U
0x0080 7365 722d 4167 656e 743a 2063 7572 6c2f ser-Agent:.curl/
0x0090 382e 352e 300d 0a41 6363 6570 743a 202a 8.5.0..Accept:.*
0x00a0 2f2a 0d0a 4175 7468 6f72 697a 6174 696f /*..Authorizatio
0x00b0 6e3a 2042 6561 7265 7220 5445 5354 544f n:.Bearer.TESTTO
0x00c0 4b45 4e0d 0a43 6f6e 7465 6e74 2d74 7970 KEN..Content-typ
0x00d0 653a 2061 7070 6c69 6361 7469 6f6e 2f6a e:.application/j
0x00e0 736f 6e0d 0a43 6f6e 7465 6e74 2d4c 656e son..Content-Len
0x00f0 6774 683a 2032 330d 0a0d 0a7b 226e 616d gth:.23....{"nam
0x0100 6522 3a22 4b65 7669 6e20 4775 656e 6179 e":"Kevin.Guenay
0x0110 227d "}
2026-08-14 19:31:34.524774 VL_TEST -- 178.63.67.153.443 -> 192.168.1.151.46574: ack 221
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c2b8 b23f 4399 c0a8 .(....@....?C...
0x0020 0197 01bb b5ee 0000 0001 0000 00dd 5010 ..............P.
0x0030 ffff 3f35 0000 ..?5..
2026-08-14 19:31:34.524777 VL_TEST -- 192.168.1.202.46574 -> 178.63.67.153.443: 1 ack 1
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0104 0000 0000 4006 c1a9 c0a8 01ca b23f ......@........?
0x0020 4399 b5ee 01bb 0000 0001 0000 0001 5010 C.............P.
0x0030 ffff 28e4 0000 504f 5354 202f 3366 6139 ..(...POST./6z79
0x0040 3933 6537 2d34 3637 392d 3430 3033 2d62 93e7-4679-4003-b
0x0050 3466 312d 3138 6637 3262 3632 3866 6531 4f1-18f72b628fe1
0x0060 2048 5454 502f 312e 310d 0a48 6f73 743a .HTTP/1.1..Host:
0x0070 2077 6562 686f 6f6b 2e73 6974 650d 0a55 .webhook.site..U
0x0080 7365 722d 4167 656e 743a 2063 7572 6c2f ser-Agent:.curl/
0x0090 382e 352e 300d 0a41 6363 6570 743a 202a 8.5.0..Accept:.*
0x00a0 2f2a 0d0a 4175 7468 6f72 697a 6174 696f /*..Authorizatio
0x00b0 6e3a 2042 6561 7265 7220 5445 5354 544f n:.Bearer.TESTTO
0x00c0 4b45 4e0d 0a43 6f6e 7465 6e74 2d74 7970 KEN..Content-typ
0x00d0 653a 2061 7070 6c69 6361 7469 6f6e 2f6a e:.application/j
0x00e0 736f 6e0d 0a43 6f6e 7465 6e74 2d4c 656e son..Content-Len
0x00f0 6774 683a 2032 330d 0a0d 0a7b 226e 616d gth:.23....{"nam
0x0100 6522 3a22 4b65 7669 6e20 4775 656e 6179 e":"Kevin.Guenay
0x0110 227d "}
2026-08-14 19:31:34.524781 VL_TEST -- 178.63.67.153.443 -> 192.168.1.202.46574: ack 221
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c285 b23f 4399 c0a8 .(....@....?C...
0x0020 01ca 01bb b5ee 0000 0001 0000 00dd 5010 ..............P.
0x0030 ffff 3f02 0000 ..?...
2026-08-14 19:31:34.572780 VL_TEST -- 178.63.67.153.443 -> 192.168.1.202.46574: 1 ack 221
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 028e 0000 0000 4006 c01f b23f 4399 c0a8 ......@....?C...
0x0020 01ca 01bb b5ee 0000 0001 0000 00dd 5010 ..............P.
0x0030 ffff 36c3 0000 4854 5450 2f31 2e31 2032 ..6...HTTP/1.1.2
0x0040 3030 204f 4b0d 0a73 6572 7665 723a 206e 00.OK..server:.n
0x0050 6769 6e78 0d0a 636f 6e74 656e 742d 7479 ginx..content-ty
0x0060 7065 3a20 7465 7874 2f68 746d 6c3b 2063 pe:.text/html;.c
0x0070 6861 7273 6574 3d55 5446 2d38 0d0a 7472 harset=UTF-8..tr
0x0080 616e 7366 6572 2d65 6e63 6f64 696e 673a ansfer-encoding:
0x0090 2063 6875 6e6b 6564 0d0a 782d 7265 7175 .chunked..x-requ
0x00a0 6573 742d 6964 3a20 3661 3164 6430 6238 est-id:.6a1dd0b8
0x00b0 2d35 3135 632d 3462 3836 2d61 3362 662d -515c-4b86-a3bf-
0x00c0 6336 3138 6630 6334 6161 3961 0d0a 782d c618f0c4aa9a..x-
0x00d0 746f 6b65 6e2d 6964 3a20 3366 6139 3933 token-id:.6z7993
0x00e0 6537 2d34 3637 392d 3430 3033 2d62 3466 e7-4679-4003-b4f
0x00f0 312d 3138 6637 3262 3632 3866 6531 0d0a 1-18f72b628fe1..
0x0100 636f 6e74 656e 742d 7365 6375 7269 7479 content-security
0x0110 2d70 6f6c 6963 793a 2073 6967 6e75 702d -policy:.signup-
0x0120 746f 2d72 656d 6f76 652d 6373 702d 6865 to-remove-csp-he
0x0130 6164 6572 2027 7765 6268 6f6f 6b2e 7369 ader.'webhook.si
0x0140 7465 2f72 6567 6973 7465 7227 3b20 6261 te/register';.ba
0x0150 7365 2d75 7269 2027 7365 6c66 273b 2066 se-uri.'self';.f
0x0160 6f72 6d2d 6163 7469 6f6e 2027 6e6f 6e65 orm-action.'none
0x0170 273b 2073 6372 6970 742d 7372 6320 276e ';.script-src.'n
0x0180 6f6e 6527 3b20 776f 726b 6572 2d73 7263 one';.worker-src
0x0190 2027 6e6f 6e65 273b 2066 7261 6d65 2d73 .'none';.frame-s
0x01a0 7263 2027 6e6f 6e65 273b 0d0a 6361 6368 rc.'none';..cach
0x01b0 652d 636f 6e74 726f 6c3a 206e 6f2d 6361 e-control:.no-ca
0x01c0 6368 652c 2070 7269 7661 7465 0d0a 6461 che,.private..da
0x01d0 7465 3a20 4672 692c 2031 3420 4175 6720 te:.Fri,.14.Aug.
0x01e0 3230 3236 2031 393a 3331 3a33 3420 474d 2026.19:31:34.GM
0x01f0 540d 0a0d 0a39 430d 0a54 6869 7320 5552 T....9C..This.UR
0x0200 4c20 6861 7320 6e6f 2064 6566 6175 6c74 L.has.no.default
0x0210 2063 6f6e 7465 6e74 2063 6f6e 6669 6775 .content.configu
0x0220 7265 642e 203c 6120 6872 6566 3d22 6874 red..<a.href="ht
0x0230 7470 733a 2f2f 7765 6268 6f6f 6b2e 7369 tps://webhook.si
0x0240 7465 2f23 212f 6564 6974 2f33 6661 3939 te/#!/edit/6z799
0x0250 3365 372d 3436 3739 2d34 3030 332d 6234 3e7-4679-4003-b4
0x0260 6631 2d31 3866 3732 6236 3238 6665 3122 f1-18f72b628fe1"
0x0270 3e43 6861 6e67 6520 7265 7370 6f6e 7365 >Change.response
0x0280 2069 6e20 5765 6268 6f6f 6b2e 7369 7465 .in.Webhook.site
0x0290 3c2f 613e 2e0d 0a30 0d0a 0d0a </a>...0....
2026-08-14 19:31:34.572785 VL_TEST -- 192.168.1.202.46574 -> 178.63.67.153.443: ack 615
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c285 c0a8 01ca b23f .(....@........?
0x0020 4399 b5ee 01bb 0000 00dd 0000 0267 5010 C............gP.
0x0030 ffff 3c9c 0000 ..<...
2026-08-14 19:31:34.572788 VL_TEST -- 178.63.67.153.443 -> 192.168.1.151.46574: 1 ack 221
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 028e 0000 0000 4006 c052 b23f 4399 c0a8 ......@..R.?C...
0x0020 0197 01bb b5ee 0000 0001 0000 00dd 5010 ..............P.
0x0030 ffff 36f6 0000 4854 5450 2f31 2e31 2032 ..6...HTTP/1.1.2
0x0040 3030 204f 4b0d 0a73 6572 7665 723a 206e 00.OK..server:.n
0x0050 6769 6e78 0d0a 636f 6e74 656e 742d 7479 ginx..content-ty
0x0060 7065 3a20 7465 7874 2f68 746d 6c3b 2063 pe:.text/html;.c
0x0070 6861 7273 6574 3d55 5446 2d38 0d0a 7472 harset=UTF-8..tr
0x0080 616e 7366 6572 2d65 6e63 6f64 696e 673a ansfer-encoding:
0x0090 2063 6875 6e6b 6564 0d0a 782d 7265 7175 .chunked..x-requ
0x00a0 6573 742d 6964 3a20 3661 3164 6430 6238 est-id:.6a1dd0b8
0x00b0 2d35 3135 632d 3462 3836 2d61 3362 662d -515c-4b86-a3bf-
0x00c0 6336 3138 6630 6334 6161 3961 0d0a 782d c618f0c4aa9a..x-
0x00d0 746f 6b65 6e2d 6964 3a20 3366 6139 3933 token-id:.6z7993
0x00e0 6537 2d34 3637 392d 3430 3033 2d62 3466 e7-4679-4003-b4f
0x00f0 312d 3138 6637 3262 3632 3866 6531 0d0a 1-18f72b628fe1..
0x0100 636f 6e74 656e 742d 7365 6375 7269 7479 content-security
0x0110 2d70 6f6c 6963 793a 2073 6967 6e75 702d -policy:.signup-
0x0120 746f 2d72 656d 6f76 652d 6373 702d 6865 to-remove-csp-he
0x0130 6164 6572 2027 7765 6268 6f6f 6b2e 7369 ader.'webhook.si
0x0140 7465 2f72 6567 6973 7465 7227 3b20 6261 te/register';.ba
0x0150 7365 2d75 7269 2027 7365 6c66 273b 2066 se-uri.'self';.f
0x0160 6f72 6d2d 6163 7469 6f6e 2027 6e6f 6e65 orm-action.'none
0x0170 273b 2073 6372 6970 742d 7372 6320 276e ';.script-src.'n
0x0180 6f6e 6527 3b20 776f 726b 6572 2d73 7263 one';.worker-src
0x0190 2027 6e6f 6e65 273b 2066 7261 6d65 2d73 .'none';.frame-s
0x01a0 7263 2027 6e6f 6e65 273b 0d0a 6361 6368 rc.'none';..cach
0x01b0 652d 636f 6e74 726f 6c3a 206e 6f2d 6361 e-control:.no-ca
0x01c0 6368 652c 2070 7269 7661 7465 0d0a 6461 che,.private..da
0x01d0 7465 3a20 4672 692c 2031 3420 4175 6720 te:.Fri,.14.Aug.
0x01e0 3230 3236 2031 393a 3331 3a33 3420 474d 2026.19:31:34.GM
0x01f0 540d 0a0d 0a39 430d 0a54 6869 7320 5552 T....9C..This.UR
0x0200 4c20 6861 7320 6e6f 2064 6566 6175 6c74 L.has.no.default
0x0210 2063 6f6e 7465 6e74 2063 6f6e 6669 6775 .content.configu
0x0220 7265 642e 203c 6120 6872 6566 3d22 6874 red..<a.href="ht
0x0230 7470 733a 2f2f 7765 6268 6f6f 6b2e 7369 tps://webhook.si
0x0240 7465 2f23 212f 6564 6974 2f33 6661 3939 te/#!/edit/6z799
0x0250 3365 372d 3436 3739 2d34 3030 332d 6234 3e7-4679-4003-b4
0x0260 6631 2d31 3866 3732 6236 3238 6665 3122 f1-18f72b628fe1"
0x0270 3e43 6861 6e67 6520 7265 7370 6f6e 7365 >Change.response
0x0280 2069 6e20 5765 6268 6f6f 6b2e 7369 7465 .in.Webhook.site
0x0290 3c2f 613e 2e0d 0a30 0d0a 0d0a </a>...0....
2026-08-14 19:31:34.572791 VL_TEST -- 192.168.1.151.46574 -> 178.63.67.153.443: ack 615
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c2b8 c0a8 0197 b23f .(....@........?
0x0020 4399 b5ee 01bb 0000 00dd 0000 0267 5010 C............gP.
0x0030 ffff 3ccf 0000 ..<...
2026-08-14 19:31:34.573101 VL_TEST -- 192.168.1.151.46574 -> 178.63.67.153.443: rst 221
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c2b8 c0a8 0197 b23f .(....@........?
0x0020 4399 b5ee 01bb 0000 00dd 0000 0000 5004 C.............P.
0x0030 ffff 3f42 0000 ..?B..
2026-08-14 19:31:34.573125 VL_TEST -- 178.63.67.153.443 -> 192.168.1.202.46574: fin 615
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c285 b23f 4399 c0a8 .(....@....?C...
0x0020 01ca 01bb b5ee 0000 0267 0000 0000 5001 .........g....P.
0x0030 ffff 3d88 0000 ..=...
2026-08-14 19:31:34.573128 VL_TEST -- 192.168.1.202.46574 -> 178.63.67.153.443: fin 221 ack 616
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c285 c0a8 01ca b23f .(....@........?
0x0020 4399 b5ee 01bb 0000 00dd 0000 0268 5011 C............hP.
0x0030 ffff 3c9a 0000 ..<...
2026-08-14 19:31:34.573131 VL_TEST -- 178.63.67.153.443 -> 192.168.1.202.46574: ack 222
0x0000 ffff ffff ffff 0009 0f09 0100 0800 4500 ..............E.
0x0010 0028 0000 0000 4006 c285 b23f 4399 c0a8 .(....@....?C...
0x0020 01ca 01bb b5ee 0000 0268 0000 00de 5010 .........h....P.
0x0030 ffff 3c9a 0000 ..<...Short and sweet and done
Both of these tips are closely related because I worked with both of them due to the same partner request at work, and I thought they were interesting enough for a post. Two people, both from Fortinet, helped me in exploring these tips. Maximilian Schiffner, an often-used source of knowledge, and another person who I am sure prefers to be anonymous, but if you ever needed help with authentication questions in the Fortinet ecosystem, you probably stumbled across something from him.
I hope, dear reader, that these tips help you.