Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between a multipart form and a URL-encoded form?
Short answer
Form data is sent in the request body in two common formats. URL encoded form (application/x-www-form-urlencoded) writes all fields as a single text in the name=value&name2=value2 format and encodes special characters with percent-encoding; it is suitable for short text fields. Multipart form (multipart/form-data) carries each field as a separate part separated by a boundary string; each part can have its own headers, and this format is used in file uploads. In TR7, the two formats are selected in the Body Type field in the HTTP requests that AGS sends to an external service (in Authentication Providers of the HTTP type and in MFA profiles with the HTTP OTP method; default JSON). The WAF, on the other hand, examines both formats as the Form section: with the default settings, field names and values go through the signature scan, and in multipart requests the uploaded files and the whole body are additionally scanned.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Providers → Provider Type: HTTP | Body Type → Multipart form / URL encoded form (default JSON) | The body format of the request going to the authentication service; the fields are made up of the Body Parameters table |
| AGS → Authentication → Multi-Factor Authentication (MFA) → MFA Method: HTTP OTP | Body Type → Multipart form / URL encoded form (default JSON) | The body format of the request going to the service that sends the OTP |
| Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → Form | OWASP Check, OWASP Check in Upload | Running the form fields and the uploaded files through the signature scan |
Comparison
| URL encoded form | Multipart form | |
|---|---|---|
| Content-Type | application/x-www-form-urlencoded | multipart/form-data; boundary=… |
| Structure | Single text: name=value&name2=value2 | Parts separated by a boundary, each part with its own headers |
| Special characters | Encoded with percent-encoding | Carried as they are inside the part |
| File upload | Not suitable | Suitable |
| Definition | WHATWG URL Standard | RFC 7578 |
Details of how the WAF scans the two formats: Is form data scanned both raw and URL-decoded? · In multipart requests, is the whole body scanned separately as well? · Is the content of uploaded files scanned as well (OWASP Check in Upload)?
Common Misconceptions
- "A file can also be sent with a URL encoded form." When the browser sends, in URL encoded format, a form that has a file field, it sends not the content of the file but only its name; a multipart form is used for uploading files.
- "In a multipart request, the WAF inspects only the files." The names and values of the form fields are scanned too; the whole body also goes through a separate scan.
- "The WAF decodes the two formats in the same way." URL encoded form fields are scanned in their raw form and in their once URL-decoded form; multipart form fields are scanned only in their raw form.
How it is done in the documentation
