Web Application Firewall (WAF)
The Web Application Firewall (WAF) is designed to protect web applications from various network attacks, such as Cross-Site Scripting (XSS), SQL Injection, and other threats.
Parameter Description
| Parameter Name | Data Type | Required | Description |
|---|---|---|---|
| rule_sets | array | Yes | List of names of the rule sets that need to be enabled |
| action | string | Yes | The action to take when WAF protection is triggered. Options: log, block or its alias 403 Forbidden, edge-captcha, hcaptcha, redirect, page-template, close-connection, redirect-validate, js-challenge, custom-action, pat-attest |
| sensitivity | string | Yes | WAF protection sensitivity level, options are high, medium, low, none |
| score | number | No | Custom sensitivity score when sensitivity is set to none |
| clearance | number | No | The validity period after the captcha is triggered, default value is 60 seconds |
| redirect_url | string | No | The specified redirect URL when the action is set to redirect |
| page_template_name | string | No | Name of the global page template. Required for page-template, or for pat-attest when fallback_action is page-template |
| page_template_status_code | number | No | HTTP status code returned by page-template. Do not set it for pat-attest |
| module_name | string | No | Lua module name. Required when action is custom-action |
| fallback_action | string | No | Challenge used by pat-attest when the client has no valid Private Access Token. Options: edge-captcha, hcaptcha, js-challenge, page-template; defaults to edge-captcha |
| cross_requests | bool | No | Set to true to enable cross-request mode. The default value is true, recommended to be set to false |
| rule_sets_threshold | list | No | Set sensitivity scores individually for each rule set, which must correspond with the rule sets listed in rule_sets |
You can choose to use built-in rule sets or customize your WAF ones. Below is a list of available built-in WAF rule sets:
- scanner_detection
- protocol_enforcement
- protocol_attack
- application_attack_lfi
- application_attack_rfi
- application_attack_rce
- application_attack_php
- application_attack_nodejs
- application_attack_xss
- application_attack_sqli
- application_attack_session_fixation
- application_attack_java
Configuration Example
- enable_rule: true
conditions:
- op: eq
var: uri
val: /waf
waf:
rule_sets:
- scanner_detection
- protocol_enforcement
- application_attack_xss
- application_attack_sqli
sensitivity: medium
action: "403 Forbidden"
cross_requests: false
In the example above, WAF is enabled when the request’s URI is /waf, and the enabled rule sets include scanner_detection, protocol_enforcement, application_attack_xss, and application_attack_sqli, with the protection sensitivity level set to medium. Once the WAF protection mechanism is triggered, the action is performed, and the HTTP status code 403 is returned, indicating that the request is forbidden.
The following example runs the sentinel Lua module as a custom WAF action:
- enable_rule: true
conditions:
- op: eq
var: uri
val: /custom-action
waf:
rule_sets:
- scanner_detection
action: custom-action
module_name: sentinel
The following example verifies a Private Access Token and falls back to a global page template named pat-tmpl. edge2yaml resolves the template name to its ID during import and restores the name during export. Do not set page_template_status_code for pat-attest.
- enable_rule: true
conditions:
- op: eq
var: uri
val: /pat-attest
waf:
rule_sets:
- scanner_detection
action: pat-attest
fallback_action: page-template
page_template_name: pat-tmpl