Web App Firewall

JSON Cross-Site Scripting protection check

If an incoming JSON payload has a malicious cross-site scripting data, WAF blocks the request. The following procedures explain how you can configure this through CLI and GUI interfaces.

Configure JSON Cross-Site Scripting protection

For configure JSON XSS protection, you must complete the following steps:

  1. Add application firewall profile as JSON.
  2. Configure JSON XSS action to block XSS malicious payload

Add application firewall profile of type JSON

You must first create a profile that specifies how the application firewall must protect your JSON web content from JSON XSS attack.

At the command prompt, type:

add appfw profile <name> -type (HTML | XML | JSON)


When you set the profile type as JSON, other checks such as HTML or XML will not applicable.


add appfw profile profile1 –type JSON

Sample output for JSON XSS violation

JSONXSSAction: block log stats
Payload: {"username":"<a href=\"jAvAsCrIpT:alert(1)\">X</a>","password":"xyz"}

Log message: Aug 19 06:57:33 <local0.info> 08/19/2019:06:57:33 GMT  0-PPE-0 : default APPFW APPFW_JSON_XSS 58 0 : 12-PPE0 - profjson Cross-site script check failed for object value(with violation="Bad URL: jAvAsCrIpT:alert(1)") starting at offset(12). <blocked>

   1  357000                  1 as_viol_json_xss
   3  0                       1 as_log_json_xss
   5  0                       1 as_viol_json_xss_profile appfw__(profjson)
   7  0                       1 as_log_json_xss_profile appfw__(profjson)

Configure JSON Cross-Site Scripting action

You must configure one or more JSON XSS actions to protection your application from JSON Cross-Site Scripting attacks. At the command prompt, type:

set appfw profile <name> - JSONXSSAction [block] [log] [stats] [none]


set appfw profile profile1 –JSONXSSAction block

The available Cross-Site Scripting actions are: Block - Block connections that violate this security check. Log - Log violations of this security check. Stats - Generate statistics for this security check. None - Disable all actions for this security check.

Note: To enable one or more actions, type “set appfw profile - JSONXSSAction “ followed by the actions to be enabled.


set appfw profile profile1 -JSONSQLInjectionAction block log stat

Configure JSON Cross Site Scripting (XSS) protection by using Citrix GUI

Follow the procedure below to set the Cross Site Scripting (XSS) protection settings.

  1. On the navigation pane, navigate to Security > Profiles.
  2. In the Profiles page, click Add.
  3. In the Citrix Web App Firewall Profile page, click Security Checks under Advanced Settings.
  4. In the Security Checks section, go to JSON Cross-Site Scripting (XSS) settings.
  5. Click the executable icon near the checkbox.

    JSON XSS Security Check

  6. Click Action Settings to access the JSON Cross-Site Scripting Settings page.
  7. Select the JSON XSS actions.
  8. Click OK.

    JSON XSS Security Check

  9. In the Citrix Web App Firewall Profile page, click Relaxation Rules under Advanced Settings.
  10. In Relaxation Rules section, select JSON Cross-Site Scripting settings and click Edit.

    JSON XSS Security Check

  11. In the JSON Cross-Site Scripting Relaxation Rule page, click Add to add a JSON Cross-Site Scripting relaxation rule.
  12. Enter the URL to which the request has to be sent. All requests sent to this URL will not be blocked.
  13. Click Create.

    JSON XSS Security Check

JSON Cross-Site Scripting protection check