In Web App Firewall
In Citrix ADC 13.0
In Citrix ADC
In All products
Product documentation
In Web App Firewall
In Citrix ADC 13.0
In Citrix ADC
In All products
Citrix ADC
Current Release 12.1 11.1
View PDF

Enforce HTTP RFC compliance

January 25, 2021
Contributed by: 
C

Citrix Web App Firewall inspects the incoming traffic for HTTP RFC compliance and drops any request that has RFC violations by default. However, there are certain scenarios, where the appliance might have to bypass or block a non-RFC compliance request. In such cases, you can configure the appliance to bypass or block such requests at global or profile level.

Block or bypass non-RFC compliant requests at global level

The HTTP module tags a request as invalid if it is incomplete or invalid and such requests cannot be processed by WAF. For example, an incoming HTTP request having host header missing. To block or bypass such invalid requests, you must configure the “malformedReqAction” option in the application firewall global settings.

Note:

If you disable the “block” option in the “malformedReqAction” parameter, the appliance bypasses the entire app firewall processing for all non-RFC compliance requests and forwards the requests to the next module.

To block or bypass invalid non-RFC compliant HTTP requests by using the command line interface

To block or bypass invalid requests, enter the following command:

set appfw settings -malformedreqaction <action>

Example:

set appfw settings –malformedReqAction block

To display malformed request action settings

To display malformed request action settings, enter the following command:

show appfw settings

Output:

DefaultProfile:  APPFW_BYPASS UndefAction:  APPFW_BLOCK SessionTimeout:  900     LearnRateLimit:  400     SessionLifetime:  0 SessionCookieName:  citrix_ns_id ImportSizeLimit:  134217728 SignatureAutoUpdate:  OFF SignatureUrl:"https://s3.amazonaws.com/NSAppFwSignatures/SignaturesMapping.xml" CookiePostEncryptPrefix:  ENC GeoLocationLogging:  OFF CEFLogging:  OFF       EntityDecoding:  OFF     UseConfigurableSecretKey:  OFF SessionLimit:  100000    MalformedReqAction:  block log stats
 Done

To block or bypass invalid non-RFC compliant HTTP requests by using the Citrix ADC GUI

  1. Navigate to Security > Citrix Web App Firewall.
  2. In the Citrix Web App Firewall page, click Change Engine Settings under Settings.
  3. In the Configure Citrix Web App Firewall Settings page, select the Log Malformed Request option as Block, Log or Stats.
  4. Click OK and Close.

Note:

If you unselect the “block” action or do not select any malformed request action, the appliance bypasses the request without intimating the user.

Block or bypass non-RFC compliant requests at profile level

Other non-RFC compliant requests can be configured to block or bypass at profile level. You must set the RFC profile either in “Block” or “Bypass” mode. By doing this, any invalid traffic that matches the Web App Firewall profile is either bypassed or blocked accordingly.

Note:

When you set the RFC profile in “Bypass” mode, you must make sure you disable the transformation option in the “HTML Cross-Site Scripting Settings” and in the “HTML SQL Injection Settings” sections. If you enable the option and set the rfc profile in “Bypass” mode, the appliance displays a warning message, “Transform cross-site scripts” and “Transform SQL special characters” are both currently ON. Recommend to turn it off when used with APPFW_RFC_BYPASS”.

Important:

Also, the appliance displays a warning note, “Appfw Security checks enabled might not be applicable to requests which violates RFC checks when this profile is set. Enabling any transformation setting is not recommended as requests might be partially transformed that contains RFC violations.”

To configure RFC profile in the Web App Firewall profile by using the command line interface

At the command prompt, type the following commands:

set appfw profile <profile_name> -rfcprofile <rfcprofile_name

Example

set appfw profile P1 -rfcprofile APPFW_RFC_BLOCK

Note:

By default, the rfc profile is bound to the Web App Firewall profile in “Block” mode.

To configure RFC profile in the Web App Firewall profile by using the GUI

  1. Navigate to Security > Citrix Web App Firewall > Profiles.
  2. In the Profiles page, select a profile and click Edit.
  3. In the Web App Firewall Profile page, click Profile settings from Advanced Settings section.
  4. In the HTTP Settings section, set the RFC profile in APPFW_RFC_BYPASS mode. The system displays a warning message, “Appfw Security checks enabled might not be applicable to requests which violates RFC checks when this profile is set. Enabling any transformation setting is not recommended as requests might be partially transformed that contains RFC violations”.
Enforce HTTP RFC compliance
January 25, 2021
Contributed by: 
C
January 25, 2021
Contributed by: 
C

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings
© 1999- Citrix Systems, Inc. All rights reserved.