Introduction

• Web Application Security

• How The App Firewall Works

• The App Firewall Configuration Interfaces

Configuring the App Firewall

• Enabling the App Firewall

• The App Firewall Wizard

• Manual Configuration

• Manual Configuration By Using the Configuration Utility

• Manual Configuration By Using the Command Line Interface

Signatures

• Manually Configuring the Signatures Feature

• Adding or Removing a Signatures Object

• Configuring or Modifying a Signatures Object

• Protecting JSON Applications using Signatures

• Updating a Signatures Object

• Exporting a Signatures Object to a File

• The Signatures Editor

  • To add a signature rule category

  • Signature Rule Patterns

  • To Import and Merge Rules

• Signature Updates in High-Availability Deployment and Build Upgrades

Top-Level Protections

• HTML Cross-Site Scripting Check

• HTML SQL Injection Checks

• Buffer Overflow Check

• Cookie Consistency Check

• App Firewall Support for Google Web Toolkit

Data Leak Prevention Checks

• Credit Card Check

• Safe Object Check

Advanced Form Protection Checks

• Field Formats Check

• Form Field Consistency Check

• CSRF Form Tagging Check

• Managing CSRF Form Tagging Check Relaxations

URL Protection Checks

• Start URL Check

• Deny URL Check

XML Protection Checks

• XML Format Check

• XML Denial-of-Service Check

• XML Cross-Site Scripting Check

• XML SQL Injection Check

• XML Attachment Check

• Web Services Interoperability Check

• XML Message Validation Check

• XML SOAP Fault Filtering Check

Profiles

• Creating App Firewall Profiles

• Configuring App Firewall Profiles

• Changing an App Firewall Profile Type

• Exporting and Importing an App Firewall Profile

• Configuring and Using the Learning Feature

• Supplemental Information about Profiles

Policies

• Firewall Policies

  • Creating and Configuring App Firewall Policies

  • Binding App Firewall Policies

  • Viewing a Firewall Policy's Bindings

  • Supplemental Information about App Firewall Policies

• Auditing Policies

Imports

• Importing and Exporting Files

Global Configuration

• Engine Settings

• Confidential Fields

• Field Types

• XML Content Types

• JSON Content Types

Appendices

• PCRE Character Encoding Format

• Whitehat WASC Signature Types for WAF Use

• Streaming Support for Request Processing

• Trace HTML Requests with Security Logs

• App Firewall Support for Cluster Configurations

Debugging and Troubleshooting

• High CPU

• Memory

• Large File Upload Failure

• Learning

• Signatures

• Trace Log

• Miscellaneous

• References