Web Application Firewall profile settings
Following are the general application firewall profile settings that you must configure on the appliance.
At the command prompt, type:
add appfw profile <name> [-invalidPercentHandling <invalidPercentHandling>] [-checkRequestHeaders ( ON | OFF )] [-URLDecodeRequestCookies ( ON | OFF )] [-optimizePartialReqs ( ON | OFF )] [-errorURL <expression>]
add appfw profile profile1 [-invalidPercentHandling secure_mode] [-checkRequestHeaders ON] [-URLDecodeRequestCookies OFF] [-optimizePartialReqs OFF]
invalidPercentHandling. Configure the method that the application firewall uses to handle percent-encoded names and values.
Available settings function as follows:
asp_mode - Strips and Parses Invalid Percent for Parsing. Example:-
curl –v “http://<vip>/forms/login.html?field=sel%zzect -> Invalid percent encoded char(%zz) is stripped of and the content is inspected and action taken for SQLInjection check.
secure_mode - We detect the Invalid Percent coded value and ignore it. Example:-
curl –v “http://<vip>/forms/login.html?field=sel%zzect -> Invalid percent encoded char(%zz) is detected, counters are incremented and content is passed as is to the server.
apache_mode - This mode works as same as the secure mode.
Possible values: apache_mode, asp_mode, secure_mode
Default value: secure_mode
optimizePartialReqs. Optimize handle of HTTP partial requests with range headers.
Available settings are as follows:
ON - Partial requests by the client result in partial requests to the back-end server.
OFF - Partial requests by the client are changed to full requests to the back-end server.
Possible values: ON, OFF Default value: ON
URLDecodeRequestCookies. URL Decode request cookies before subjecting them to SQL and cross-site scripting checks.
Possible values: ON, OFF Default value: OFF
Signature Post Body Limit (Bytes). Limits the request payload (in bytes) inspected for signatures with location specified as ‘HTTP_POST_BODY’.
Default value: 8096 Minimum value: 0 Maximum Value: 4294967295
Post Body Limit (Bytes). Limits the request payload (in bytes) inspected by Web Application Firewall.
Default value: 20000000 Minimum value: 0 Maximum Value: 10 GB
checkRequestQueryNonHtml = ON/OFF (Check request query parameters and web forms for injected SQL and cross-site scripts irrespective of content-type)
set appfw profile <name> -checkRequestQueryNonHtml (ON|OFF)
For appfw profile basic type, this is turned off by default. For appfw profile advanced type, this is turned on by default.
After you upgrade your appliance, you can see an increase in number of violations to advanced Web Application Firewall profiles if the option turned on, by default. Make sure you explicitly disable the option if it is not required.
errorURL expression. The URL that Citrix Web App Firewall uses as an error URL.
Maximum Length: 2047
For blocking violations in a signature for a requested URL, if the error URL is same as the signature URL the appliance redirects the URL instead of a connection reset. This change is applicable only in Citrix ADC version 13.0 and later.