<p>I am using Istio VirtualService and am wondering if it's possible to use the header rules to deny requests on specific routes if a header is missing.</p>
<p>per the docs it looks like we can only add or remove headers at virtualservice level? Is that correct?</p>
<p>Or in what way can I blanket deny requests to specific URI paths in the virtualservice without a specific header?</p>

Papi Abi
<p>Virtual service focuses only on <a href="https://istio.io/v1.1/docs/tasks/policy-enforcement/control-headers/" rel="nofollow noreferrer">rewriting and routing</a> including headers and it doesnt support denying traffic without the header. However Upon checking <a href="https://istio.io/latest/docs/reference/config/networking/envoy-filter/" rel="nofollow noreferrer">EnvoyFilter</a> it can manipulate deny requests based on header condition.</p>
<p>Sharing also this <a href="https://discuss.istio.io/t/add-headers-using-virtual-service/2786" rel="nofollow noreferrer">link</a> where one of the comments uses EnvoyFilter to manipulate header rules. Please check the sample yaml below if this fits your concern.</p>
<pre><code>kind: EnvoyFilter
metadata:
  name: any-name
spec:
  workloadSelector:
    labels:
      app: your-app
  filters:
    - listenerMatch:
        listenerType: SIDECAR_INBOUND
        listenerProtocol: HTTP
      filterName: envoy.lua
      filterType: HTTP
      filterConfig:
        inlineCode: |
          function envoy_on_request(request_handle)
            local header_value = request_handle:headers():get(&quot;Your-Header-Name&quot;)
            if header_value == nil then
              request_handle:respond({[&quot;:status&quot;] = &quot;403&quot;}, &quot;Header is missing&quot;)
            end
          end
</code></pre>
