Enforce HTTP RFC compliance
The Citrix Web Web App Firewall (WAF) complies with HTTP RFC by inspecting the web traffic (both request and response messages) and dropping a message that does not comply to RFC compliance. However, there are scenarios where the appliance might have to bypass a non-RFC compliant web traffic. In such cases, the appliance allows the traffic by bypassing the RFC checks.
In WAF, you can block or bypass web traffic by setting the RFC profile in the Profile Settings section. You can set the RFC profile either in “Block” or “Bypass” mode. By doing this, any invalid traffic that matches the Web App Firewall profile will be either bypassed or blocked accordingly.
Note: When you set the RFC profile in “Bypass” mode, you must make sure you disable the transformation option in the “HTML Cross-Site Scripting Settings” and in the “HTML SQL Injection Settings” sections. If you enable the option and set the rfc profile in “Bypass” mode, the appliance displays a warning message, “Transform cross-site scripts” and “Transform SQL special characters” are both currently ON. Recommend to turn it off when used with APPFW_RFC_BYPASS”. Important: Also, the appliance displays a warning note, “Appfw Security checks enabled might not be applicable to requests which violates RFC checks when this profile is set. Enabling any transformation setting is not recommended as requests might be partially transformed that contains RFC violations.”
To configure RFC profile in the Web App Firewall profile by using the command line interface
At the command prompt, type the following commands:
set appfw profile <profile_name> -rfcprofile <rfcprofile_name
set appfw profile P1 -rfcprofile APPFW_RFC_BLOCK
Note: By default, the rfc profile is bound to the Web App Firewall profile in “Block” mode.
To configure RFC profile in the Web App Firewall profile by using the GUI
- Navigate to Security > Application Firewall > Profiles.
- In the Profiles page, select a profile and click Edit.
- In the Web App Firewall Profile page, click Profile settings from Advanced Settings section.
- In the HTTP Settings section, set the RFC profile in APPFW_RFC_BYPASS mode. The system displays a warning message, “Appfw Security checks enabled might not be applicable to requests which violates RFC checks when this profile is set. Enabling any transformation setting is not recommended as requests might be partially transformed that contains RFC violations”.