JSON Cross-Site Scripting protection check
If an incoming JSON payload has a malicious cross-site scripting data, WAF blocks the request. The following procedures explain how you can configure this through CLI and GUI interfaces.
Configure JSON Cross-Site Scripting protection
For configure JSON XSS protection, you must complete the following steps:
- Add application firewall profile as JSON.
- Configure JSON XSS action to block XSS malicious payload
Add application firewall profile of type JSON
You must first create a profile that specifies how the application firewall must protect your JSON web content from JSON XSS attack.
At the command prompt, type:
add appfw profile <name> -type (HTML | XML | JSON)
When you set the profile type as JSON, other checks such as HTML or XML will not applicable.
add appfw profile profile1 –type JSON
Sample output for JSON XSS violation
Configure JSON Cross-Site Scripting action
You must configure one or more JSON XSS actions to protection your application from JSON Cross-Site Scripting attacks. At the command prompt, type:
set appfw profile <name> - JSONXSSAction [block] [log] [stats] [none]
set appfw profile profile1 –JSONXSSAction block
The available Cross-Site Scripting actions are: Block - Block connections that violate this security check. Log - Log violations of this security check. Stats - Generate statistics for this security check. None - Disable all actions for this security check.
Note: To enable one or more actions, type “set appfw profile - JSONXSSAction “ followed by the actions to be enabled.
set appfw profile profile1 -JSONSQLInjectionAction block log stat
Configure JSON Cross Site Scripting (XSS) protection by using Citrix GUI
Follow the procedure below to set the Cross Site Scripting (XSS) protection settings.
- On the navigation pane, navigate to Security > Profiles.
- In the Profiles page, click Add.
- In the Citrix Web App Firewall Profile page, click Security Checks under Advanced Settings.
- In the Security Checks section, go to JSON Cross-Site Scripting (XSS) settings.
Click the executable icon near the checkbox.
- Click Action Settings to access the JSON Cross-Site Scripting Settings page.
- Select the JSON XSS actions.
- In the Citrix Web App Firewall Profile page, click Relaxation Rules under Advanced Settings.
In Relaxation Rules section, select JSON Cross-Site Scripting settings and click Edit.
- In the JSON Cross-Site Scripting Relaxation Rule page, click Add to add a JSON Cross-Site Scripting relaxation rule.
- Enter the URL to which the request has to be sent. All requests sent to this URL will not be blocked.