Redirect requests with rules

A web proxy's Redirects tab holds two kinds of redirect. Redirect rules send the paths they match to another address, and every other request still reaches the origin. A whole-domain redirect answers every request for the name, and Coritan's network never contacts the origin. A website's Rules tab holds the same two cards for each of its hostnames (Redirect visitors and set headers).

• The web proxy's name is not under a domain on your Domain Management list. A web proxy that is, opens on that website: its redirects are on the Rules tab (Redirect visitors and set headers).
• Decide where each redirect goes: a full URL, such as https://www.example.com/new-page, or a path on the same name, such as /new-page.

1. In the dashboard, go to Game Shield, select the web proxy in the Web proxies tab and select the Redirects tab.
2. On the Path redirects card, select New rule…. The New redirect rule page opens under the tab, at /dashboard/proxies/web/<id>/redirects/new, with Redirects as its back link.
3. In the What to match section, choose the Match: Exact path, Path prefix or Regular expression (How rules match).
4. Enter the Source path, such as /old-page.
5. In the Where visitors go section, enter the Destination: a full URL, or a path on this name that starts with a slash.
6. Choose the Status code. 301 Moved permanently and 308 Permanent redirect tell browsers and search engines that the move is permanent. 302 Found and 307 Temporary redirect say it is temporary.
7. Leave Keep the query string on to add the visitor's query string to the destination.
8. In the Order and state section, set the Priority. Coritan's network checks rules with a higher priority first. Leave Enabled on.
9. Select Create rule. A refusal, such as Source paths start with a slash, such as /old-page., appears under the field and keeps what you entered. When you have typed something, Cancel and the back link ask Leave without saving? first.

The dashboard confirms with Redirect rule created for and the web proxy's name, and returns you to the Redirects tab, where the rule is in the list.

Coritan's network checks the rules that are on from the highest priority down, and the first rule that matches answers. Give rules that can match the same path different priorities, because Coritan's network can check two rules with the same priority in either order.

A rule tests the request's path only. The query string takes no part in the match, and Coritan's network reads the path as the visitor sent it, so a space is %20.

Exact path

The path must equal the source path, letter case included. /old-page matches neither /old-page/ nor /Old-Page.

Path prefix

Every path that starts with the source path matches. /old-blog matches /old-blog/post-1 and also /old-blogroll, so end the source path with a slash, such as /old-blog/, to match one folder only. Every matching path goes to the same destination, without the rest of its path.

Regular expression

Coritan's network tests the pattern against the start of the path, with Python's regular expression syntax. End the pattern with $ to match the whole path. The destination can use the pattern's groups as \1 or \g<1>: with ^/blog/(\d+)/?$ and the destination /posts/\1, a request for /blog/42 goes to /posts/42. Write a named group as (?P<name>…). Coritan's network cannot run a few of Python's forms (What a regular expression cannot use).

A destination that is a path stays on the same name over HTTPS, so /new-page sends a visitor on www.example.com to https://www.example.com/new-page. With Keep the query string on, Coritan's network adds the visitor's query string after a ?, or after a & when the destination has a query string already.

Rules answer before the WAF checks a request and before Coritan's network contacts the origin. With Force HTTPS on, a plain HTTP request goes to HTTPS first, and the rule then answers the HTTPS request. While the web proxy has a whole-domain redirect, Coritan's network does not check its rules.

Coritan refuses a rule whose pattern uses one of the forms below, and does not save it. The message names the form by the code in brackets, such as (nullable-repeat), and each entry here says how to write the pattern instead.

nullable-repeat

A repeated group that captures and can match nothing, such as (a?)*, (a*)* or (a*)+b. Write the group without capturing, such as (?:a?)*. When the destination uses the group, capture the whole repeat instead, such as ((?:a?)*).

backref-in-loop

A back reference, such as \1, to a group inside a repeat, where the repeated text can vary in length, such as (a+)+\1. A repeat of fixed text, such as (a){2,5}\1, works. Capture the whole repeat instead, such as ((?:a+)+)\1, which refers to all of the repeated text, or match without the back reference.

backref-ignorecase

A back reference in a part of the pattern that ignores letter case, such as (?i)(a)\1. Leave out (?i), or match without the back reference.

condition-on-open-group

A conditional, such as (?(1)b), inside the group it tests, such as (a(?(1)b)). Put the conditional after the group closes, such as (a)(?(1)b).

scoped-type-flag

The flag a or u set for part of the pattern, such as (?a:\w). Set it for the whole pattern instead, with (?a) at its start.

lazy-loop-tail

A repeated group that ends with a lazy repeat, such as (?:a+?)*, in a pattern that also has a lookaround, such as (?=b), or a back reference. Use a greedy repeat, such as (?:a+)*(?=b).

named-escape

A character written by its name, such as \N{BULLET}. Write the character itself, or its code, such as \u2022.

repeat-too-large

A repeat too large to compile, such as \w{2000}. \w and \d match the letters and digits of every language, so a long repeat of them grows large. Use a smaller count, or name the characters, such as [A-Za-z0-9_]{2000}.

engine

A pattern too complex to compile, such as capturing groups nested about 250 deep, or a conditional inside an atomic group, such as (a)(?>(?(1)b)). Simplify the pattern, or split it into several rules.

The Path redirects table lists the rules from the highest priority down, with the Source and its match, the Destination, the Code, the Priority and whether the rule is Enabled.

• To turn a rule off or on, use its switch in the Enabled column. A rule that is off stays in the list and never matches.
• To change a rule, open its menu, select Edit rule…, make the changes on the Edit redirect rule page and select Save rule. The page's address ends in the rule's number, so you can bookmark it.
• To delete a rule, open its menu and select Delete rule…. A question asks Delete the redirect for /old-page?. Select Delete rule, and requests for its path reach the origin again.

A whole-domain redirect sends every request for the name to another address, such as example.com to https://www.example.com. The name that receives the traffic needs its own web proxy or site.

1. On the Redirects tab, find the Whole-domain redirect card and select Set redirect.
2. Enter the Destination, a full URL that starts with https://, such as https://www.example.com. It can end in a path, such as https://www.example.com/shop. Coritan's network sends visitors on over HTTPS only.
3. Choose the Status code.
4. Leave Keep the request path ticked to send each path to the same path at the destination. Untick it to send every request to the destination itself.
5. Leave Keep the query string ticked to keep the visitor's query string.
6. Check the example under the fields, such as For example, example.com/blog?page=2 goes to https://www.example.com/blog?page=2., then select Save redirect.

The redirect answers before Force HTTPS and before any redirect rule. The card then says Every visitor goes to https://www.example.com, with the status code and an example. Edit changes it, and Remove stops it, so requests reach the origin again.

• The dashboard confirms Redirect rule created for www.example.com., Redirect rule updated for www.example.com., Redirect for /old-page on www.example.com turned off. or Redirect rule deleted from www.example.com. for a rule, and Whole-domain redirect saved. or Whole-domain redirect removed. for the whole-domain redirect.
• A matching request gets the status code you chose, with the destination in its Location header.

Enter a source path, such as /old-page. or Enter a destination, such as /new-page.

The field is empty. Fill it in.

Source paths start with a slash, such as /old-page.

Exact and prefix rules take a path, such as /old-page, and never a full URL. To redirect a whole name, use Redirect the whole domain.

The regular expression does not compile. Check its brackets and backslashes.

The pattern has a syntax error, such as a bracket that is never closed. Correct it. The dashboard checks the pattern in your browser first, and a few of Python's forms fail there too: conditionals such as (a)(?(1)b), atomic groups such as (?>a) and possessive repeats such as a*+. Add a rule that uses one with the API.

Write a named group as (?P<name>…), the form our network reads.

Coritan's network reads Python's syntax, and a pattern with (?<name>…) would never match. Write (?P<name>…) instead.

source_pattern uses something our network does not support (nullable-repeat): …

The pattern uses a form that Coritan's network cannot run, and the code in brackets names it. The page shows the message under Could not create the rule or Could not save the rule, and keeps what you entered. Write the pattern as What a regular expression cannot use says for that code, then save again.

source_pattern is not a valid regex: …

Python's syntax does not allow the pattern, and the message says why and where, such as bad escape \p at position 0. Correct the pattern at that position.

source_pattern: we could not check whether our network can run it. Try again, or simplify it

Coritan could not finish checking the pattern. Save the rule again, and if the message comes back, simplify the pattern.

The destination is a full URL, such as https://www.example.com/new-page, or a path on this hostname, such as /new-page.

Start the rule's destination with https://, http:// or /.

Start the destination with https://. Our network sends every visitor on over HTTPS.

The whole-domain destination starts with http://. Enter it with https://.

The destination is a full URL, such as https://www.example.com.

The whole-domain destination has no https:// at its start. Enter the full address.

Leave ? and # out of the destination. Keep the query string passes on the visitor's own query.

The whole-domain destination cannot hold a query string or a fragment. Enter it without them, and leave Keep the query string ticked to pass on the visitor's own.

www.example.com cannot redirect to itself. Enter another hostname.

The destination is the web proxy's own name, which would send visitors round in a loop. To send http:// visitors to https://, turn on Force HTTPS. To move a page within the name, add a redirect rule.

A rule never matches

Check that the rule is on, and that the path matches letter for letter. A rule with a higher priority can answer first, and no rule answers while a whole-domain redirect is set.

Visitors go round in a loop

The destination matches the rule's own source, such as a prefix rule for /docs that sends visitors to /docs/new. Use an exact rule, end a regular expression with $, or choose a destination outside the source path.

Visitors still get a redirect you changed or deleted

Browsers keep 301 and 308 redirects and follow them without asking again. Clear the browser's cache to test, and use 302 or 307 while you try a rule out.

• How web proxies work
• Change a web proxy's origin
• Change a web proxy's settings

List a web proxy's rules with GET /api/v1/proxy/routes/{route_id}/redirect-rules. The answer is a list, from the highest priority down:

curl https://api.coritan.com/api/v1/proxy/routes/31/redirect-rules \
  -H "Authorization: Bearer $CORITAN_TOKEN"

[
  {
    "id": 7,
    "source_pattern": "/old-page",
    "match_type": "exact",
    "target_url": "/new-page",
    "status_code": 301,
    "preserve_query": true,
    "priority": 10,
    "enabled": true,
    "created_at": "2026-09-02 08:15:40"
  }
]

Add a rule with POST /api/v1/proxy/routes/{route_id}/redirect-rules. source_pattern and target_url are required. match_type is exact, prefix or regex, exact by default. status_code is 301, 302, 307 or 308, 301 by default. preserve_query and enabled are true by default, and priority is 0.

curl -X POST https://api.coritan.com/api/v1/proxy/routes/31/redirect-rules \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"source_pattern": "^/blog/(\\d+)/?$", "match_type": "regex", "target_url": "/posts/\\1", "status_code": 308, "priority": 20}'

{"id": 8, "message": "Redirect rule created"}

The API checks a regular expression as Coritan's network reads it (What a regular expression cannot use). It does not check the rest the way the dashboard does: start an exact or prefix source path with a slash, and send a destination that is a full URL or a path.

Change a rule with PATCH /api/v1/proxy/routes/{route_id}/redirect-rules/{rule_id}, with only the fields you change. It answers {"message": "Redirect rule updated"}, and No fields to update when the body holds none. Delete a rule with DELETE on the same path, which answers {"message": "Redirect rule deleted"}:

curl -X DELETE https://api.coritan.com/api/v1/proxy/routes/31/redirect-rules/8 \
  -H "Authorization: Bearer $CORITAN_TOKEN"

A match_type or status_code outside the lists answers 400 with match_type must be exact, prefix, or regex or status_code must be 301, 302, 307, or 308. A regular expression answers 400 with source_pattern is not a valid regex: and Python's reason when Python's syntax does not allow it, and with source_pattern uses something our network does not support and the code when Coritan's network cannot run it. PATCH checks the pattern when the body changes source_pattern or match_type. A web proxy that is not on your account answers 404 with Route not found.

The whole-domain redirect is part of the web proxy itself. Set it with PATCH /api/v1/proxy/routes/{route_id} and the redirect_to, redirect_status_code, redirect_preserve_path and redirect_preserve_query fields, and remove it with an empty redirect_to (Change a web proxy's origin). Send redirect_to without https://, such as www.example.com or www.example.com/shop, because Coritan's network puts https:// in front of it. A leading https:// or http:// you send is dropped.

curl -X PATCH https://api.coritan.com/api/v1/proxy/routes/31 \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"redirect_to": "www.example.com", "redirect_status_code": 301, "redirect_preserve_path": true}'

A web proxy that only redirects needs no origin. Create it with redirect_to in place of upstream_host (Create a web proxy).