# Access an HTTP service

Last validated Aug 7, 2026

> **Note:** Border0 + Tailscale is currently in beta.

Use Border0 + Tailscale to provide fine-grained privileged access controls, credential management, and auditing for HTTP services in your Tailscale network (known as a tailnet). Privileged users can access an HTTP service using their [Tailscale identity][docs-tailscale-identity], and organizations benefit from centralized access control and detailed audit logs.

## Prerequisites

Before you begin, confirm you have the following:

* A [connector][docs-border0-connectors].
* A device on your network that provides an HTTP/HTTPS service that you want to make available to your users.

## Create an HTTP socket

Create an HTTP service [socket][docs-border0-sockets] and link it to your connector.

1. In the Border0 admin portal, open the [**Sockets**][xt-border0-sockets-page] page.
2. Select **Add New Socket**.
3. Select **HTTP**.
4. In the **Web App** section, select **Create**.
5. Select **I will use my own web app**.
6. In the **Socket Information** section:
   1. Provide a name for your socket. A socket name can have alphanumeric characters and hyphens, but it must start or end with an alphanumeric character.
   2. (Optional) Select **Add display name** and provide a display name for the socket.
   3. (Optional) Provide a description for the socket.
   4. Use the **Session Recording** dropdown menu to select whether session recording is enabled or disabled.
7. In the **Upstream Configuration** section:
   1. For **Upstream Type**, select either **HTTP** or **HTTPS**.
   2. For **Hostname**, provide the hostname. For purposes of this guide, use `www.example.com`. Adjust as needed for your network.
   3. (Optional) For **Host / SNI header**, provide the Server Name Indication (SNI) hostname that the user is trying to reach before encryption is established. Border0 can use the SNI value to determine which protected service should receive the TLS connection. For purposes of this guide, use `www.example.com`. Adjust as needed for your network.
   4. (Optional) For **HTTP headers**, if you want to add any HTTP header key-value pairs, select **Add Header** and add the keys and values.
8. In the **Connectors** section, select the connector that you want to use for this socket.
9. (Optional) In the **Tags** section, select **Add tag** to add any tags that you want to use for the socket.
10. Select **Create New Socket**.

Your HTTP service socket has been created. You can access it in the [**Sockets**][xt-border0-sockets-page] page.

### Use an internal web application

While this guide uses `www.example.com` as the host, you can use any HTTP endpoint. That includes private internal web applications. As long as your connector has access to the web app, you can provide privileged access to any HTTP/HTTPS service that is available. For example, `https://10.10.10.10`.

## Connect to the HTTP service

To connect to the HTTP service that you set up:

1. Open the URL that you configured when you created the HTTP socket. Alternatively, from the **Sockets** page, select **Connect**.
2. Follow the prompts to authenticate, and your HTTP service session begins.

When you are done interacting with the HTTP service, close your browser or switch to a URL that is different than your HTTP service URL. That effectively ends your HTTP session.

### Modify the access policy

By default, the organization-wide policies are applied for your socket.

If you want to modify the policy for this socket, select **Policies** in the Border0 admin portal and make updates as needed.

## Review session details and recordings

To review details like the identity, originating IP address, device, connection time, and other activity, open the [**Sessions**][xt-border0-sessions-page] page and select a session. Alternatively, you can find the sessions by opening the [**Sockets**][xt-border0-sockets-page] page, selecting your HTTP socket, and then selecting **Sessions**.

If you enabled session recording, you can replay the session. An HTTP session recording will show you the rendering of the HTTP Document Object Model (DOM) data.

For more information, refer to [Session logs][docs-border0-session-logs].

## Pass user information from Border0 into your web app

It is helpful to know what user is making the HTTP requests to your internal web application. The Border0 identity-aware proxy makes that information available to your web app by adding extra HTTP headers to the upstream request. The following table contains the supported headers.

| HTTP header          | Example value                            |
| -------------------- | ---------------------------------------- |
| `"X-Auth-Email"`     | `"ameliepangolin@gmail.com"`             |
| `"X-Auth-Expiresin"` | `"1234567890"`                           |
| `"X-Auth-Name"`      | `"Amelie Pangolin"`                      |
| `"X-Auth-Subject"`   | `"1234abcd-56ef-78ab-1111-abcd1234efab"` |
| `"X-Auth-Userid"`    | `"ameliepangolin@gmail.com"`             |
| `"X-Auth-Username"`  | `"ameliepangolin@gmail.com"`             |

## Next steps

For information about using Tailscale identity in an HTTP service integrated with Grafana, refer to [Use Tailscale identity in your Grafana HTTP service][docs-border0-grafana].

[docs-border0-connectors]: /docs/border0/connectors

[docs-border0-grafana]: /docs/border0/how-to/access-http-service/grafana

[docs-border0-session-logs]: /docs/border0/session-logs

[docs-border0-sockets]: /docs/border0/services

[docs-tailscale-identity]: /docs/concepts/tailscale-identity

[xt-border0-sessions-page]: https://portal.border0.com/sessions

[xt-border0-sockets-page]: https://portal.border0.com/mysockets