cookies

Yes

array of objects

This section defines Cookie entities for your policy. You can specify the cookies that you want to allow, and the ones you want to enforce in a security policy:

• Allowed cookies: The system allows these cookies and clients can change them.
• Enforced cookies: The system enforces the cookies in the list (not allowing clients to change them) and allows clients to change all others.

How the system processes a request that triggers a security policy violation.

• Blocking: When the enforcement mode is set to blocking, traffic is blocked if it causes a violation (configured for blocking).
• Transparent: When the enforcement mode is set to transparent, traffic is not blocked even if a violation is triggered.

• blocking
• transparent

filetypes

Yes

array of objects

File types are categorization of the URLs in the request by the extension appearing past the last dot at the end of the URL. For example, the file type of /index.php is "php". Other well known file types are html, aspx, png, jpeg and many more. A special case is the "empty" file type called "no-ext" meaning, no extension in which the URL has no dot at its last segment as in /foo_no_dot

File types usually imply the expected content type in the response. For example, html and php return HTML content, while jpeg, png and gif return images, each in its respective format. File types also imply the server technology deployed for rendering the page. For example, php (PHP), aspx (ASP) and many others.

The security policy uses file types for several purposes:

1. Ability to define which file types are allowed and which are disallowed. By including the pure wildcard "*" file type and a list of disallowed file types you have a file type denylist. By having a list of explicit file type without the pure wildcard "*" you have a file type allowlist.

2. Each file type implies maximum length restrictions for the requests of that file type. The checked lengths are per the URL, Query String, total request length, and payload (POST data).
3. Each file type determines whether to detect response signatures for requests of that file type. Typically, one would never check signatures for image file types.

• header
• query

• integer minimum: 1 maximum: 65536
• string

• Integer values
• "any"

Notes:

• The system does not validate that the cookie has not been modified or intercepted.
• The feature covers all security policy cookies, both enforced and allowed, explicit and wildcard.

decodeValueAsBase64

string

Specifies whether the the system should detect or require values to be Base64 encoded:

• disabled: the value will not be decoded as Base64 content.
• enabled: the value will be checked whether it can be decoded as Base64 and, if so, security checks will be performed on the decoded value.
• required: the value must be decoded as Base64, and security checks will be performed on the decoded value.

Note: This setting is only relevant if the Cookie Enforcement Type is set to Allowed.

• disabled
• enabled
• required

insertSameSiteAttribute

string

The introduction of the SameSite http attribute (defined in [RFC6265bis](https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00)) allows you to declare if your cookie should be restricted to a first-party or same-site context. Introducing the SameSite attribute on a cookie provides three different ways of controlling same-site vs. cross-site cookie sending:

• strict: Cookie will only be sent in a first-party context. In user terms, the cookie will only be sent if the site for the cookie matches the site currently shown in the browser's URL bar.
• lax: Cookies will be sent with top level navigation
• none-value: Cookies will be sent in a third-party context.

• lax
• none
• none-value
• strict

name

string

Specifies the cookie name as appearing in the http cookie header. The cookie name length is limited to 500 characters.

Names can be one of the following according to the type attribute:

• explicit: Specifies that the cookie has a specific name and is not a wildcard entity. Type the name of a cookie exactly as you expect it to appear in the request.
• wildcard: Specifies that any cookie that matches the listed wildcard expression should be treated according to the wildcard attributes. Type a wildcard expression that matches the expected cookie. For example, the wildcard expression cookie_12* of type Enforced specifies that the security policy should not allow modified domain cookies for all cookies which match cookie_12*.

The syntax for wildcard entities is based on shell-style wildcard characters. The list below describes the wildcard characters that you can use so that the entity name can match multiple objects.

• *: Matches all characters
• ?: Matches any single character
• [abcde]: Matches exactly one of the characters listed
• [!abcde]: Matches any character not listed
• [a-e]: Matches exactly one character in the range
• [!a-e]: Matches any character not in the range

Note: Wildcards do not match regular expressions. Do not use a regular expression as a wildcard.

• none
• verify-origin

enforcementMode

string

Specifies the URLs for which the system enforces data guard protection.

• ignore-urls-in-list: Specifies that the system enforces data guard protection for all URLs except for those URLs in the Enforcement Mode list.
• enforce-urls-in-list: Specifies that the system enforces data guard protection only for those URLs in the Enforcement Mode list

• enforce-urls-in-list
• ignore-urls-in-list

secureAttribute

string

The value for the state cookie Secure attribute:

• always: Always add the Secure attribute to the state cookie.
• never: The Secure attribute is never added to the state cookie.

• always
• never

1. No allowed file type matched the file type of the request.
2. The file type of the request matched a disallowed file type.

maskCreditCardNumbersInRequest

boolean

When enabled, the security policy masks credit card numbers that appear in any part of requests. The system does not mask the information in the actual requests, but rather in various logs:

• Credit card numbers appearing in entity names are masked in the requests of the Requests log.

* Credit card numbers appearing in entity values are masked wherever requests can be viewed: the Requests log, and violation details within that log. This setting is enabled by default, and exists in addition to masking parameters defined as containing sensitive information.

• integer minimum: 0 maximum: 2147483647
• string

• Integer values
• "any"

• integer minimum: 0 maximum: 2147483647
• string

• Integer values
• "any"

• disabled
• enabled

• integer minimum: 1 maximum: 65536
• string

• Integer values
• "any"

• integer minimum: 0 maximum: 2147483647
• string

• Integer values
• "any"

• integer minimum: 0 maximum: 2147483647
• string

• Integer values
• "any"

actionType

string

The action to take when the override rule is matched. Possible values are:

• extend-policy: The override policy inherits the containing policy settings, allowing only the required settings to be overridden.
• replace-policy: The override policy must be a valid declarative policy that includes a name, template and all necessary settings.
• violation: The request is blocked and a the VIOL_RULE is logged based on the provided violation settings.

• extend-policy
• replace-policy
• violation

arraySerializationFormat

string

Specifies type of serialization for array of primitives parameter. Serialization defines how multiple values are delimited - format that can be transmitted and reconstructed later:

• pipe: pipe-separated values. Array color=["blue","black"] -> color=blue|black.
• form: ampersand-separated values. Array color=["blue","black"] -> color=blue,black.
• matrix: semicolon-prefixed values. Array color=["blue","black"] -> ;color=blue,black.
• tsv: tab-separated values. Array color=["blue","black"] -> color=bluetblack.
• csv: comma-separated values. Array color=["blue","black"] -> color=blue,black.
• label: dot-prefixed values. Array color=["blue","black"] -> .blue.black.
• multi: multiple parameter instances rather than multiple values. Array color=["blue","black"] -> color=blue&color=black.
• ssv: space-separated values. Array color=["blue","black"] -> color=blue black.
• multipart: defines array of files.

Notes:

• This attribute is relevant only for parameters with array valueType.
• multi and form serializations can be defined for parameter with query, form-data or cookie locations only.
• multipart serialization can be defined for parameter with form-data location only.
• matrix and label serializations can be defined for parameter with path location only.

• csv
• form
• label
• matrix
• multi
• multipart
• pipe
• ssv
• tsv

dataType

string

Specifies data type of parameter's value:

• alpha-numeric: specifies that the value of parameter can be any text consisting of letters, digits, and the underscore character.
• binary: specifies there is no text limit for the value of a parameter (length checks only).
• phone: specifies that the value of a parameter can be text in telephone number format only.
• email: specifies that the value of a parameter must be text in email format only.
• boolean: specifies that the value of a parameter must be boolean (only true and false values are allowed).
• integer: specifies that the value of a parameter must be whole numbers only (no decimals).
• decimal: specifies that the value of a parameter is numbers only and can include decimals.

Notes:

• This attribute is relevant for parameters with array or user-input valueType only.

• alpha-numeric
• binary
• phone
• email
• boolean
• integer
• decimal

Notes:

• This attribute is not relevant for parameters with deep-object, space-delimited or pipe-delimited objectSerializationStyle.

• global
• url

name

string

Specifies the name of a parameter which must be permitted in requests. Format of parameter name attribute differs depending on type attribute: - explicit type: name of permitted parameter in request should literally match. - wildcard type: name of permitted parameter in request should match wildcard expression.

The syntax for wildcard entities is based on shell-style wildcard characters. The list below describes the wildcard characters that you can use so that the entity name can match multiple objects.

• *: Matches all characters
• ?: Matches any single character
• [abcde]: Matches exactly one of the characters listed
• [!abcde]: Matches any character not listed
• [a-e]: Matches exactly one character in the range
• [!a-e]: Matches any character not in the range

Notes:

• Wildcards do not match regular expressions. Do not use a regular expression as a wildcard.
• Empty parameter name is allowed for explicit type

objectSerializationStyle

string

Specifies the type of serialization for an object or complex array parameter. Serialization defines how multiple values are delimited - format that can be transmitted and reconstructed later:

• pipe-delimited: pipe-separated values. Object color={"R":100,"G":200} -> color=RG|200.
• form: ampersand-separated values. Object color={"R":100,"G":200} -> color=R,100,G,200 if explodeObjectSerialization set to false or -> R=100&G=200 if explodeObjectSerialization set to true.
• space-delimited: space-separated values. Object color={"R":100,"G":200} -> color=R 100 G 200.
• deep-object: rendering nested objects. Object color={"R":100,"G":200} -> color[R]=100&color[G]=200.
• matrix: semicolon-prefixed values. Object color={"R":100,"G":200} -> ;color=R,100,G,200 if explodeObjectSerialization set to false or -> ;R=100;G=200 if explodeObjectSerialization set to true.
• simple: comma-separated values. Object color={"R":100,"G":200} -> R,100,G,200 if explodeObjectSerialization set to false or -> R=100,G=200 if explodeObjectSerialization set to true.
• label: dot-prefixed values. Object color={"R":100,"G":200} -> .R.100.G.200 if explodeObjectSerialization set to false or -> .R=100.G=200 if explodeObjectSerialization set to true.

Notes:

• This attribute is relevant only for parameters with object or openapi-array valueType.
• form serialization can be defined for a parameter with query, form-data or cookie locations only.
• matrix and label serializations can be defined for an array parameter with path location only.
• simple serializations can be defined for a parameter with path and header locations only.
• deep-object serialization can be defined for a parameter with query or form-data locations only.

• deep-object
• form
• label
• matrix
• pipe-delimited
• simple
• space-delimited

parameterLocation

string

Specifies location of parameter in request:

• any: in query string, in POST data (body) or in URL path.
• query: in query string.
• form-data: in POST data (body).
• cookie: in value of Cookie header.
• path: in URL path.
• header: in request headers.

Notes:

• path location can be defined for parameter with global level only.
• path, header and cookie location can be defined for parameter with explicit type only.
• header and cookie location cannot be defined for parameter with empty name.

• any
• cookie
• form-data
• header
• path
• query

valueType

string

Specifies type of parameter's value:

• object: the parameter's value is complex object defined by JSON schema.
• dynamic-content: the parameter's content changes dynamically.
• openapi-array: the parameter's value is complex array defined by JSON schema.
• ignore: the system does not perform validity checks on the value of the parameter.
• static-content: the parameter has a static, or pre-defined, value(s).
• json: the parameter's value is JSON data.
• array: the parameter's value is array of primitives.
• user-input: the parameter's value is provided by user-input.
• xml: the parameter's value is XML data.
• auto-detect: the parameter's value can be user-input, XML data or JSON data. The system automatically classifies the type of value.
• dynamic-parameter-name: the parameter's name changes dynamically.

Notes:

• dynamic-parameter-name value type can be defined for a parameter with flow level and explicit type only.
• dynamic-content value type can be defined for a parameter with explicit type only.

• array
• auto-detect
• ignore
• json
• object
• openapi-array
• static-content
• user-input
• xml

Which content, or URL, the system sends to the client as a response to an AJAX request that does not comply with the security policy.

• alert-popup: The system opens a message as a popup screen. Type the message the system displays in the popup screen, or leave the default text.
• custom: A response text that will replace the frame or page which generated the AJAX request. The system provides additional options where you can type the response body you prefer.
• redirect: The system redirects the user to a specific web page instead of viewing a response page. Type the web page's full URL path, for example, http://www.redirectpage.com.

• alert-popup
• custom
• redirect

The different types of blocking response pages which are available from the system:

• ajax: The system sends the AJAX Blocking Response Page when the security policy blocks an AJAX request that does not comply with the security policy.
• default: The system sends the default response when the security policy blocks a client request.
• graphql: The system sends the GraphQL response when the security policy blocks a client request that contains GraphQL message that does not comply with the settings of a GraphQL profile configured in the security policy.
• grpc: The system sends the gRPC response when the security policy blocks a client request that contains gRPC message that does not comply with the settings of a gRPC profile configured in the security policy.
• xml: The system sends the XML response page when the security policy blocks a client request that contains XML content that does not comply with the settings of an XML profile configured in the security policy.

• ajax
• default
• graphql
• grpc
• xml

• ASP
• ASP.NET
• AngularJS
• Apache Struts
• Apache Tomcat
• Apache/NCSA HTTP Server
• BEA Systems WebLogic Server
• Backbone.js
• CGI
• Cisco
• Citrix
• CodeIgniter
• CouchDB
• Django
• Elasticsearch
• Ember.js
• Express.js
• Front Page Server Extensions (FPSE)
• Google Web Toolkit
• GraphQL
• Handlebars
• IBM DB2
• IIS
• JBoss
• Java Servlets/JSP
• JavaScript
• JavaServer Faces (JSF)
• Jenkins
• Jetty
• Joomla
• Laravel
• Lotus Domino
• Macromedia ColdFusion
• Macromedia JRun
• Microsoft SQL Server
• Microsoft Windows
• MongoDB
• MooTools
• Mustache
• MySQL
• Neo4J
• Nginx
• Node.js
• Novell
• Oracle
• Oracle Application Server
• Oracle Identity Manager
• Outlook Web Access
• PHP
• PostgreSQL
• Prototype
• Proxy Servers
• Python
• React
• Redis
• RequireJS
• Ruby
• SQLite
• SSI (Server Side Includes)
• SharePoint
• Spring Boot
• Svelte
• Sybase/ASE
• TYPO3 CMS
• UIKit
• Underscore.js
• Unix/Linux
• Vue.js
• WebDAV
• WordPress
• XML
• ZURB Foundation
• Zend
• ef.js
• jQuery

• all
• eq
• ge
• le

• after
• all
• before

• all
• eq
• ge
• le

• all
• request
• response

• high
• low
• medium

name

string

Specifies an HTTP URL that the security policy allows. The available types are:

• Explicit: Specifies that the URL has a specific name and is not a wildcard entity. Type the name of a URL exactly as you expect it to appear in the request.
• Wildcard: Specifies that any URL that matches the listed wildcard expression should be treated according to the wildcard attributes. Type a wildcard expression that matches the expected URL. For example, entering the wildcard expression * specifies that any URL is allowed by the security policy.

The syntax for wildcard entities is based on shell-style wildcard characters. The list below describes the wildcard characters that you can use so that the entity name can match multiple objects.

• *: Matches all characters
• ?: Matches any single character
• [abcde]: Matches exactly one of the characters listed
• [!abcde]: Matches any character not listed
• [a-e]: Matches exactly one character in the range
• [!a-e]: Matches any character not in the range

Note: Wildcards do not match regular expressions. Do not use a regular expression as a wildcard.

• replace-with
• unmodified

• integer minimum: 0 maximum: 65535
• string

• Integer values
• "all"

• integer
• string

• Integer values
• "default"

• Apply Content Signatures: Do not parse the content; scan the entire payload with full-content attack signatures.
  • Apply Value and Content Signatures: Do not parse the content or extract parameters; process the entire payload with value and full-content attack signatures.
  • Disallow: Block requests for an URL containing this header content. Log the Illegal Request Content Type violation.
  • Do Nothing: Do not inspect or parse the content. Handle the header of the request as specified by the security policy.
  • Form Data: Parse content as posted form data in either URL-encoded or multi-part formats. Enforce the form parameters according to the policy.
  • GWT: Perform checks for data in requests, based on the configuration of the GWT (Google Web Toolkit) profile associated with this URL.
  • JSON: Review JSON data using an associated JSON profile, and use value attack signatures to scan the element values.
  • XML: Review XML data using an associated XML profile.

• apply-content-signatures
• apply-value-and-content-signatures
• disallow
• do-nothing
• form-data
• graphql
• grpc
• json
• xml

Specifies how the system responds to blocking requests sent from this IP address.

• Policy Default: Specifies that the Policy Blocking Settings will be used for requests from this IP address.
• Never Block: Specifies that the system does not block requests sent from this IP address, even if your security policy is configured to block all traffic.
• Always Block: Specifies that the system blocks requests sent from this IP address on condition that IP is denylisted is set to Block under Policy Building Settings.

• always
• never
• policy-default

• integer minimum: 0 maximum: 2147483647
• string

• Integer values
• "any"

• integer minimum: 0 maximum: 2147483647
• string

• Integer values
• "any"

• integer minimum: 0 maximum: 2147483647
• string

• Integer values
• "any"

• integer minimum: 0 maximum: 2147483647
• string

• Integer values
• "any"

• integer minimum: 0 maximum: 2147483647
• string

• Integer values
• "any"

• %u decoding
• Apache whitespace
• Bad unescape
• Bare byte decoding
• Directory traversals
• IIS Unicode codepoints
• IIS backslashes
• Multiple decoding
• Multiple slashes
• Semicolon path parameters

• POST request with Content-Length: 0
• Multiple host headers
• Host header contains IP address
• Null in request
• Header name with no header value
• Chunked request with Content-Length header
• Check maximum number of cookies
• Check maximum number of parameters
• Check maximum number of headers
• Body in GET or HEAD requests
• Bad multipart/form-data request parsing
• Bad multipart parameters parsing
• Unescaped space in URL
• High ASCII characters in headers

• VIOL_ACCESS_UNAUTHORIZED
• VIOL_ACCESS_INVALID
• VIOL_ACCESS_MALFORMED
• VIOL_ACCESS_MISSING
• VIOL_ASM_COOKIE_MODIFIED
• VIOL_BLACKLISTED_IP
• VIOL_COOKIE_EXPIRED
• VIOL_COOKIE_LENGTH
• VIOL_COOKIE_MALFORMED
• VIOL_COOKIE_MODIFIED
• VIOL_CSRF
• VIOL_DATA_GUARD
• VIOL_ENCODING
• VIOL_EVASION
• VIOL_FILETYPE
• VIOL_FILE_UPLOAD
• VIOL_FILE_UPLOAD_IN_BODY
• VIOL_GRAPHQL_MALFORMED
• VIOL_GRAPHQL_FORMAT
• VIOL_GRAPHQL_INTROSPECTION_QUERY
• VIOL_GRAPHQL_ERROR_RESPONSE
• VIOL_GRPC_FORMAT
• VIOL_GRPC_MALFORMED
• VIOL_GRPC_METHOD
• VIOL_HEADER_LENGTH
• VIOL_HEADER_METACHAR
• VIOL_HEADER_REPEATED
• VIOL_HTTP_PROTOCOL
• VIOL_HTTP_RESPONSE_STATUS
• VIOL_JSON_FORMAT
• VIOL_JSON_MALFORMED
• VIOL_JSON_SCHEMA
• VIOL_MANDATORY_HEADER
• VIOL_MANDATORY_PARAMETER
• VIOL_MANDATORY_REQUEST_BODY
• VIOL_METHOD
• VIOL_PARAMETER
• VIOL_PARAMETER_ARRAY_VALUE
• VIOL_PARAMETER_DATA_TYPE
• VIOL_PARAMETER_EMPTY_VALUE
• VIOL_PARAMETER_LOCATION
• VIOL_PARAMETER_MULTIPART_NULL_VALUE
• VIOL_PARAMETER_NAME_METACHAR
• VIOL_PARAMETER_NUMERIC_VALUE
• VIOL_PARAMETER_REPEATED
• VIOL_PARAMETER_STATIC_VALUE
• VIOL_PARAMETER_VALUE_BASE64
• VIOL_PARAMETER_VALUE_LENGTH
• VIOL_PARAMETER_VALUE_METACHAR
• VIOL_PARAMETER_VALUE_REGEXP
• VIOL_POST_DATA_LENGTH
• VIOL_QUERY_STRING_LENGTH
• VIOL_RATING_THREAT
• VIOL_RATING_NEED_EXAMINATION
• VIOL_REQUEST_MAX_LENGTH
• VIOL_REQUEST_LENGTH
• VIOL_THREAT_CAMPAIGN
• VIOL_URL
• VIOL_URL_CONTENT_TYPE
• VIOL_URL_LENGTH
• VIOL_URL_METACHAR
• VIOL_XML_FORMAT
• VIOL_XML_MALFORMED
• VIOL_GEOLOCATION
• VIOL_WEBSOCKET_BAD_REQUEST

• alarm
• block
• default
• detect
• ignore

• integer minimum: 0 maximum: 150
• string

• Integer values
• "default"

• alarm
• block
• detect

action

string

The action we set for this class.

• ignore: The system will not detect or report bots from this class.
• detect: The system will detect and report the bot, but violation won't be reported.
• alarm: The system will detect and report requests made by bots from this class as illegal, but will not block them.
• block: The system will detect and report requests made by bots from this class as illegal, and block them.

• alarm
• block
• detect
• ignore

action

string

The action we set for this signature.

• ignore: The system will not detect or report this signature.
• detect: The system will detect and report the signature, but violation won't be reported.
• alarm: The system will detect and report requests made by those specific bots as illegal, but will not block them.
• block: The system will detect and report requests made by those specific bots as illegal, and will block them.

• alarm
• block
• detect
• ignore