waf page-access-rule
Use this command to configure page access rules.
Page access rules define URLs that can be accessed only in a specific order, such as to enforce the business logic of a web application. Requests for other, non-ordered URLs may interleave ordered URLs during the client’s session. Page access rules may be specific to a web host.
For example, an e-commerce application might be designed to work properly in this order:
1. A client begins a session by adding an item to a shopping cart. (/addToCart.do?*)
2. The client either views and adds additional items to the shopping cart, or proceeds directly to the checkout.
3. The client confirms the items that he or she wants to purchase. (/checkout.do)
4. The client provides shipping information. (/shipment.do)
5. The client pays for the items and shipment, completing the transaction. (/payment.do)
Sessions that begin at the shipping or payment stage should therefore be invalid. If the web application does not enforce this rule itself, it could be open to cross-site request forgery (CSRF) attacks on the payment feature. To prevent such abuse, the FortiWeb appliance could enforce the rule itself using a page access rule set with the following order:
1. /addToCart.do?item=*
2. /checkout.do?login=*
3. /shipment.do
4. /payment.do
Attempts to request
/payment.do before those other URLs during a session would be denied, and generate an alert and attack log message (see
“config log disk”).
To apply page access rules, select them within an inline protection profile. For details, see
“config waf web-protection-profile inline-protection”.
Before you configure a page access rule, if you want to apply it only to HTTP requests for a specific real or virtual host, you must first define the web host in a protected hosts group. For details, see
“config server-policy allow-hosts”.
You can use SNMP traps to notify you when a page access rule is enforced. For details, see
“config system snmp community”.
To use this command, your administrator account’s access control profile must have either
w or
rw permission to the
wafgrp area. For more information, see
“Permissions”.
Syntax
config waf page-access-rule
config page-access-list
next
end
next
end
Variable | Description | Default |
<page-access-rule_name> | Type the name of a new or existing rule. The maximum length is 35 characters. To display the list of existing rules, type: edit ? | No default. |
<entry_index> | Type the index number of the individual entry in the table. The valid range is from 1 to 9,999,999,999,999,999,999. Page access rules should be added to the set in the order which clients will be permitted to access them. For example, if a client must access /login.asp before /account.asp, add the rule for /login.asp first. | No default. |
host <protected-hosts_name> | Type the name of a protected host that the Host: field of an HTTP request must be in order to match the page access rule. The maximum length is 255 characters. This setting applies only if host-status is enable. | No default. |
host-status {enable | disable} | Enable to apply this page access rule only to HTTP requests for specific web hosts. Also configure host <protected-hosts_name>. Disable to match the page access rule based upon the other criteria, such as the URL, but regardless of the Host: field. | disable |
request-file <url_str> | Depending on your selection in request-type {plain | regular}, type either: • the literal URL, such as /cart.php, that the HTTP request must contain in order to match the page access rule. The URL must begin with a slash ( / ). • a regular expression, such as ^/*.php, matching all and only the URLs to which the page access rule should apply. The pattern is not required to begin with a slash ( / ). However, it must at least match URLs that begin with a slash, such as /cart.cfm. Do not include the name of the web host, such as www.example.com, which is configured separately in host <protected-hosts_name>. The maximum length is 255 characters. Note: Regular expressions beginning with an exclamation point ( ! ) are not supported. For information on language and regular expression matching, see the FortiWeb Administration Guide. | No default. |
request-type {plain | regular} | Select whether request-file <url_str> will contain a literal URL ( plain), or a regular expression designed to match multiple URLs ( regular). | plain |
Example
This example allows any request to www.example.com, as long as it follows the expected sequence within a session for the four key shopping cart URLs (/addToCart.do, /checkout.do, /shipment.do, then /payment.do).
config waf page-access-rule
edit "page-access-rule1"
config page-access-list
edit 1
set host "www.example.com"
set host-status enable
set request-file "/addToCart.do?item=*"
set request-type regular
next
edit 2
set host "www.example.com"
set host-status enable
set request-file "/checkout.do?login=*"
set request-type regular
next
edit 3
set host "www.example.com"
set host-status enable
set request-file "/shipment.do"
set request-type plain
next
edit 4
set host "www.example.com"
set host-status enable
set request-file "/payment.do"
set request-type plain
next
end
next
end
Related topics