# HTTP Engine & Rewrites

## `[http-engine]`

This section configures the internal HTTP engine.

| Key | Type | Description |
|---|---|---|
| `enabled` | Boolean | Enables the HTTP engine. Default `false`. |
| `capture-all` | Boolean | Process every IPv4 destination on configured TCP ports; default `false`. Saved domain/CIDR lists remain intact. |
| `cidr-list` | List of IPv4 CIDRs | Additional destination-IP capture scope. |
| `port-list` | List of integers | TCP ports from 1–65535; default `80,443`. |
| `http3-policy` | `allow` or `block` | Default `allow`. Blocking HTTP/3 can encourage compatible clients to retry over TCP; it is not HTTP/3 decryption. |
| `mitm-bypass-apple-services` | Boolean | Default `true`; avoid decrypting known Apple service domains. |
| `mitm-bypass-domain-list` | List of domain suffixes | Additional domains that must not be decrypted. |
| `upstream-tcp-receive-window` | Integer | Advanced upstream receive-window size in bytes: 4096–1048576, default 262144. |
| `domain-list`| List of domain suffixes | Domains to apply HTTP processing on; supports `*` for all domains. |
| `ca-p12` | String | A base64 encoded PKCS#12 certificate authority. **Note:** Only RSA keys are currently supported. |
| `ca-passphrase`| String | The passphrase for the `ca-p12` certificate. |

**Example:**
```ini
[http-engine]
enabled=true
domain-list=example.com
ca-p12=...
ca-passphrase=...
```

## `[http-url-rewrite]`

This section defines URL rewrite rules for the HTTP engine. The key is a user-defined name for the rule.

| Key | Type | Description | Required |
|---|---|---|---|
| `match` | Regexp | A regular expression to match the URL. | Yes |
| `action` | String | The action to take. Supported: `reject`, `redirect-302`.| Yes |
| `target` | String | The target URL for redirection. | No |
| `enabled` | Boolean | Default `true`. | No |

**Example:**
```ini
[http-url-rewrite]
block-ads=match:^https?://ads\..*,action:reject
redirect-google=match:^https?://google\.com,action:redirect-302,target:https://duckduckgo.com
```

## `[http-body-rewrite]`

Named request or response body rules reference managed local scripts. The app's editor and MFHRB importer manage the script resource and its profile reference. Do not paste a remote script URL here and expect automatic fetching or updates.

| Field | Meaning |
|---|---|
| `match` | Required regex over the normalized full URL; at most 4096 UTF-8 bytes. |
| `direction` | `request` or `response`; default `response`. |
| `type` | Required: `jq` or `javascript`. |
| `body-mode` | `json` or `text`; jq requires JSON (default `json` for jq, `text` for JavaScript). |
| `script` | Required managed local resource reference, produced by the editor/importer. |
| `priority` | 0–1000000; default 100. Lower values run first; ties sort by rule name. |
| `enabled` | Default `true` in profile syntax. MFHRB imports always save it disabled. |
| `api-version` | `1`. |
| `timeout-ms` | JavaScript only: 50–2000 ms, default 500. |

The portable JSON bundle uses camel-case keys such as `bodyMode` and `timeoutMS`; profile text uses `body-mode` and `timeout-ms`. They are different formats. Use the [MFHRB guide](../howtos/http-analysis-mfhrb.md) for a complete shareable example, API contract, and review workflow.

For example, if the managed resource `./feed-cleanup/remove-banner.jq` already exists in this profile's script storage:

```ini
[http-body-rewrite]
remove-banner=match:^https://api\.example\.com/feed$,direction:response,type:jq,body-mode:json,priority:100,enabled:false,api-version:1,script:./feed-cleanup/remove-banner.jq
```

The referenced jq source could be `.items |= map(select(.kind != "banner"))` for a JSON object with an `items` array. The profile line does not create that file. Import an MFHRB bundle or use the app's script editor to manage the resource, and review it before enabling the rule.