Product Documentation

Managing CSRF Form Tagging Check Relaxations

Aug 31, 2016

You configure an exception (or relaxation) to the CSRF Form Tagging security check in the Add Cross-Site Request Forgery Tagging Check Relaxation dialog box or the Modify Cross-Site Request Forgery Tagging Check Relaxation dialog box.

To configure a CSRF Form Tagging check relaxation by using the configuration utility

  1. Navigate to Security > Application Firewall > Profiles.
  2. In the Profiles pane, select the profile you want to configure, and then click Open.
  3. In the Configure Application Firewall Profile dialog box, click the Security Checks tab. The Security Checks tab contains the list of application firewall security checks.
  4. In the Security Checks window, click CSRF Form Tagging, and then click Open. The Modify Cross-Site Request Forgery Tagging Check dialog box is displayed, with the Checks tab selected. The Checks tab contains a list of existing CSRF relaxations. The list might be empty if you have not either manually added any relaxations or approved any relaxations that were recommended by the learning engine. Beneath the list is a row of buttons that allow you to add, modify, delete, enable, or disable the relaxations on the list.
  5. To add or modify a CSRF relaxation, do one of the following:
    • To add a new relaxation, click Add.
    • To modify an existing relaxation, select the relaxation that you want to modify, and then click Open.

    The Add Cross-Site Request Forgery Tagging Check Relaxation or Modify Cross-Site Request Forgery Tagging Check Relaxation dialog box is displayed. Except for the title, these dialog boxes are identical.

  6. Fill in the dialog box as described below.
    • Enabled check box—Select to place this relaxation or rule in active use; clear to deactivate it.

    • Form Origin URL—In the text area, enter a PCRE-format regular expression that defines the URL that hosts the form.

    • Form Action URL—In the text area, enter a PCRE-format regular expression that defines the URL to which data entered into the form is delivered.

    • Comments—In the text area, type a comment. Optional.
    Note: For any element that requires a regular expression, you can type the regular expression, use the Regex Tokens menu to insert regular expression elements and symbols directly into the text box, or click Regex Editor to open the Add Regular Expression dialog box, and use it to construct the expression.
  7. Click OK. The Add Cross-Site Request Forgery Tagging Check Relaxation or Modify Cross-Site Request Forgery Tagging Check Relaxation dialog box closes and you return to the Modify Cross-Site Request Forgery Tagging Check dialog box.
  8. To remove a relaxation or rule, select it, and then click Remove.
  9. To enable a relaxation or rule, select it, and then click Enable.
  10. To disable a relaxation or rule, select it, and then click Disable.
  11. To configure the settings and relationships of all existing relaxations in an integrated interactive graphic display, click Visualizer, and use the display tools.
  12. To review and configure learned rules for the CSRF check, click Learning and perform the steps in "To configure and use the Learning feature."
  13. Click OK.