amazon web services - AWS WAF Block Requests Without Multiple Specified Headers & Values - Stack Overflow

admin管理员组

文章数量:1122832

I am trying to build out a WAF rule that will be used to protect a public endpoint.

The rule is built as follows:

1. If the path matches 'some_uri'
2. AND NOT single header 'header_1' with size greater than 0
3. AND NOT single header 'header_2' with size greater than 0
4. Block!

In simple terms, if a request is to 'some_uri' then it must have 2 (and potentially other) headers - 'header_1' and 'header_2' - that both have some non-zero value.

I am struggling to implement it and unable to determine what the cause is. The rule is defined with 2 seperate single header inspections, however it is not behaving as expected. Below are some of the test scenarios I have tried - the last is the confusing one...

• If I make a request without either of the required headers, the request is blocked (GOOD).
• If I make a request with one of the required headers without a value, the request is blocked (GOOD).
• If I make a request with both required headers without a value, the request is blocked (GOOD).
• However, if I make a request with both required headers where one has a value, the request is not blocked (BAD).

I cannot understand why the last scenario above is not being blocked..

From my testing it seems that the single header checks are 'combined' into a single test, rather than treated as two, independent evaluations.

I am trying to build out a WAF rule that will be used to protect a public endpoint.

The rule is built as follows:

1. If the path matches 'some_uri'
2. AND NOT single header 'header_1' with size greater than 0
3. AND NOT single header 'header_2' with size greater than 0
4. Block!

In simple terms, if a request is to 'some_uri' then it must have 2 (and potentially other) headers - 'header_1' and 'header_2' - that both have some non-zero value.

I am struggling to implement it and unable to determine what the cause is. The rule is defined with 2 seperate single header inspections, however it is not behaving as expected. Below are some of the test scenarios I have tried - the last is the confusing one...

• If I make a request without either of the required headers, the request is blocked (GOOD).
• If I make a request with one of the required headers without a value, the request is blocked (GOOD).
• If I make a request with both required headers without a value, the request is blocked (GOOD).
• However, if I make a request with both required headers where one has a value, the request is not blocked (BAD).

I cannot understand why the last scenario above is not being blocked..

From my testing it seems that the single header checks are 'combined' into a single test, rather than treated as two, independent evaluations.

• amazon-web-services
• amazon-waf

Share Improve this question Follow edited Nov 21, 2024 at 15:23 dingo asked Nov 21, 2024 at 15:14 dingodingo 90688 silver badges2626 bronze badges

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

This was a misunderstanding on my part about the evaluation of logic statements in WAF.

Written out, the logic statement required was: IF request_path AND NOT (header_1 AND header_2)

Where the initial implementation was: IF request_path AND NOT header_1 AND NOT header_2

My desired outcome was achieved by evaluating the presence and values of both header_1 and header_2 in a self contained AND statement within the rule.

本文标签： amazon web servicesAWS WAF Block Requests Without Multiple Specified Headers amp ValuesStack Overflow