使用用户网域限制功能控制对 Gemini Code Assist 的网络访问
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
本文档提供了有关网络管理员如何配置其网络以根据用户网域限制对 Gemini Code Assist 的访问权限的说明。借助此功能，组织可以控制其网络中哪些用户有权使用 Gemini Code Assist，从而增强安全性并防止未经授权的访问。
概览
您可以将 Gemini Code Assist 配置为使用中间人 (PITM) 代理方法强制执行用户网域限制。这涉及将自定义 HTTP 标头 X-GeminiCodeAssist-Allowed-Domains 注入对 Gemini Code Assist 发出的请求中。该标头指定了允许的网域列表，Gemini Code Assist 后端仅处理来自身份验证网域与允许网域之一匹配的用户的请求。
如需在 IDE 中配置代理，请按以下步骤操作：
VS Code
依次前往文件 > 设置（适用于 Windows），或代码 > 设置 > 设置（适用于 macOS）。
在用户标签页中，依次前往应用 > 代理。
在代理下方的框中，输入代理服务器的地址。例如 http://localhost:3128。
可选：如需配置 Gemini Code Assist 以忽略证书错误，请在 Proxy Strict SSL 下方选中或取消选中相应复选框。此设置适用于所有配置文件。
IntelliJ
依次前往文件 > 设置 (Windows) 或 IntelliJ IDEA > 设置 (macOS)。
依次前往外观和行为 > 系统设置 > HTTP 代理。
选择手动代理配置，然后选择 HTTP。
在主机名字段中，输入您的代理服务器的主机名。
在端口号字段中，输入代理服务器的端口号。
可选：如需配置 Gemini Code Assist 以忽略证书错误，请在边栏中依次点击工具 > 服务器证书，然后选择或取消选择自动接受不受信任的证书。
如需配置 PITM 代理，请按以下步骤操作：
确保您的网络使用能够拦截和修改 HTTPS 流量的 PITM 代理。
将代理配置为拦截所有发送到 Gemini Code Assist 端点 (https://cloudcode-pa.googleapis.com) 的出站请求。指定 Gemini Code Assist 端点时，请勿使用通配符 (*)。
将代理配置为将 X-GeminiCodeAssist-Allowed-Domains 标头注入到每个请求中。该标头应包含一个以英文逗号分隔的允许域名列表（例如，example.com、yourcompany.net）。请确保域名以英文逗号分隔，并且不包含 @ 符号。
如果标头未解析为至少一个有效网域，则不会应用限制。例如，空标头不会应用任何限制。
domain 不是有效的域名，因此不会受到任何限制。
当用户尝试从未包含在标头列表中的网域访问 Gemini Code Assist 时，系统会显示一条消息，告知他们管理员已限制其在网域中使用 Gemini Code Assist。
SSL/TLS 拦截
如果您的代理需要解密 HTTPS 流量以注入标头，请确保它已针对 SSL/TLS 拦截进行配置。这通常包括：
Gemini Code Assist 会自动验证 X-GeminiCodeAssist-Allowed-Domains 标头并强制执行限制。
如果该标头未解析为至少一个有效域名，则不会执行验证。
如果与用户身份验证相关联的网域不在允许列表中，请求将被拒绝。例如，如果用户使用 Gmail 账号登录，但允许列表中只有 example.com，则请求会被拒绝。
后续步骤
如需详细了解如何禁止访问个人用户账号，请参阅禁止访问个人用户账号。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-31。
[null,null,["最后更新时间 (UTC)：2025-08-31。"],[[["\u003cp\u003eNetwork administrators can restrict access to Gemini Code Assist based on user domains via a Person-in-the-Middle (PITM) proxy.\u003c/p\u003e\n"],["\u003cp\u003eA custom HTTP header, \u003ccode\u003eX-GeminiCodeAssist-Allowed-Domains\u003c/code\u003e, is injected into requests to specify a comma-separated list of allowed domains.\u003c/p\u003e\n"],["\u003cp\u003eThe PITM proxy must intercept HTTPS traffic and be configured to inject the custom header into each request.\u003c/p\u003e\n"],["\u003cp\u003eGemini Code Assist validates the \u003ccode\u003eX-GeminiCodeAssist-Allowed-Domains\u003c/code\u003e header, rejecting requests from users whose domains are not on the allowed list.\u003c/p\u003e\n"],["\u003cp\u003eIf the header doesn't resolve to at least one valid domain, then the validation won't be performed, meaning restrictions will not apply.\u003c/p\u003e\n"]]],[],null,["# Control Network Access to Gemini Code Assist with User Domain Restrictions\n\nThis document provides instructions for network administrators to configure\ntheir networks to restrict access to Gemini Code Assist based on\nuser domains. This feature allows organizations to control which users within\ntheir network can utilize Gemini Code Assist, enhancing security\nand preventing unauthorized access.\n\nOverview\n--------\n\nYou can configure Gemini Code Assist to enforce user domain\nrestrictions using a Person-in-the-Middle (PITM) proxy approach. This involves\ninjecting a custom HTTP header,\n`X-GeminiCodeAssist-Allowed-Domains`, into requests made to\nGemini Code Assist. The header specifies a list of allowed\ndomains, and the Gemini Code Assist backend only processes\nrequests from users whose authenticated domain matches one of the allowed\ndomains.\n\nConfigure a proxy in your IDE\n-----------------------------\n\nTo configure a proxy in your IDE, follow these steps: \n\n### VS Code\n\n1. Navigate to **File** \\\u003e **Settings** (for Windows), or **Code**\n \\\u003e **Settings** \\\u003e **Settings** (for macOS).\n\n2. In the **User** tab, navigate to **Application** \\\u003e **Proxy**.\n\n3. In the box under **Proxy** , enter the address of your proxy server. For\n example `http://localhost:3128`.\n\n4. Optional: To configure Gemini Code Assist to ignore\n certificate errors, under **Proxy Strict SSL**, select or deselect the\n checkbox. This setting applies to all profiles.\n\n### IntelliJ\n\n1. Navigate to **File** \\\u003e **Settings** (for Windows) or **IntelliJ\n IDEA** \\\u003e **Settings** (for macOS).\n\n2. Navigate to **Appearance \\& Behavior** \\\u003e **System Settings**\n \\\u003e **HTTP Proxy**.\n\n3. Select **Manual proxy configuration** , and then select **HTTP**.\n\n4. In the **Host name** field, enter the hostname of your proxy server.\n\n5. In the **Port number** field, enter the port number of your proxy server.\n\n6. Optional: To configure Gemini Code Assist to ignore\n certificate errors, in the sidebar, click **Tools** \\\u003e **Server\n Certificates** and then select or deselect **Accept non-trusted certificates\n automatically**.\n\nConfigure PITM proxy\n--------------------\n\nTo configure your PITM proxy, follow these steps:\n\n1. Make sure your network utilizes a PITM proxy capable of intercepting and\n modifying HTTPS traffic.\n\n2. Configure the proxy to intercept all outgoing requests to the\n Gemini Code Assist endpoint\n (`https://cloudcode-pa.googleapis.com`). Don't use wildcards (`*`) when you\n specify the Gemini Code Assist endpoint.\n\n3. Configure the proxy to inject the `X-GeminiCodeAssist-Allowed-Domains`\n header into each request. The header should contain a comma-separated list\n of allowed domains (e.g., `example.com`, `yourcompany.net`).\n Make sure that domain names are separated by commas and\n don't include the `@` symbol.\n\n If headers aren't resolved into at least one valid domain, restrictions\n won't apply. For example, an empty header won't apply any restrictions.\n `domain` won't apply any restrictions as it isn't a valid domain name.\n\nWhen a user tries to access Gemini Code Assist from a domain not\nincluded in the header list, they see a message telling them that they're\nrestricted from using Gemini Code Assist on their domain by their\nadministrator.\n\nSSL/TLS interception\n--------------------\n\nIf your proxy needs to decrypt HTTPS traffic to inject the header, make sure\nit's configured for SSL/TLS interception. This typically involves:\n\n- Generating a certificate for the proxy.\n\n- Installing the proxy's certificate on user devices to establish trust and\n avoid certificate errors.\n\nHeader validation\n-----------------\n\n- Gemini Code Assist automatically validates the\n `X-GeminiCodeAssist-Allowed-Domains` header and enforces the restrictions.\n\n- If the header doesn't resolve to at least one valid domain, the validation\n won't be performed.\n\n- If the domain associated with the user's authentication isn't in the allowed\n list, the request is rejected. For example if the user logs in with a gmail\n account and only example.com is on the allowed list, the request is rejected.\n\nWhat's next\n-----------\n\nTo learn more about blocking access to consumer accounts, see\n[Block access to consumer accounts](https://support.google.com/a/answer/1668854)."]]
