Is there protection against HTTP request smuggling and parameter pollution attacks?

Short answer

Yes; the two attacks are countered at different layers. In HTTP request smuggling, the first layer is TR7's HTTP parsing: TR7 parses and reframes the request itself before forwarding it to the Backend Service; requests that carry more than one Content-Length, or Content-Length and Transfer-Encoding together, are rejected with 400 by default. The only setting that loosens this behavior is the Accept headers not compatible with RFC7230 HTTP/0.9,HTTP/1.0 (Condition independent) option in the URL Normalization action, and it is applied to all vService traffic independent of the condition. WAF also carries 8 rules (15 signatures) in the HTTP Request Smuggling category (duplicate Transfer-Encoding and Content-Length, Transfer-Encoding manipulation, a request line embedded in a header); of these, the 3 with 2 points are loaded only at the Aggressive protection level. In parameter pollution, how many times the same parameter can come in a request is limited with the value count fields on the Query, Header and Form tabs (Query Value Count, Header Value Count, Form Value Count). The Any Paths default is 1 for header, 128 for query and 512 for form; query and form repetition does not produce a violation by default, and on API endpoints it is lowered to 1 per parameter. The 3 rules (9 signatures) in the Parameter Pollution category look for pollution done with array syntax. There is no check for a duplicate key in the JSON body.

How Does It Work?

HTTP Request Smuggling

Request smuggling exploits a proxy in front and the server behind it interpreting differently where a request ends; with conflicting Content-Length and Transfer-Encoding headers, a second request is hidden inside a request (PortSwigger: HTTP request smuggling). Since TR7 works as a full proxy, it parses the request itself and forwards it to the Backend Service over a connection it frames itself.

Layer	What it does	When it is active
HTTP parsing	Rejects with 400 the requests that carry more than one Content-Length or Host header, and those that carry Content-Length and Transfer-Encoding together	Default
Accept headers not compatible with RFC7230 HTTP/0.9,HTTP/1.0 (Condition independent)	Accepts requests that do not comply with RFC 7230; loosens the rejection in parsing	Only when selected in a URL Normalization action bound to the vService; independent of the condition, to all traffic
HTTP Request Smuggling signatures	Look for duplicate Transfer-Encoding and Content-Length in the headers, Transfer-Encoding manipulation, and a request line embedded with CRLF	While WAF is on; the 8-point ones at every level, the 2-point ones only at Aggressive

The rules of the category: HTTP Request Smuggling TE Duplicate, HTTP Request Smuggling CL Duplicate, HTTP Transfer Encoding Header Manipulation, HTTP Smuggling CRLF HTTP and HTTP Request Smuggling - Method Line in Header have 8 points; Http Request Smuggling Cl Te Conflict, Http Request Smuggling Malformed Headers and Header Smuggling Pollution have 2 points. The Bot Protection of L7 DDoS & Threat Protection also adds protocol contradictions, such as a GET request that carries a body, to the bot score as a signal (What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?).

Parameter Pollution

HTTP parameter pollution aims, by sending the same parameter more than once in a request (?id=1&id=2), to make WAF and the application read different values or to alter the application logic (OWASP Testing Guide: HTTP Parameter Pollution).

Check	Scope	Any Paths default
Query Value Count	Number of repetitions of the same query parameter	128
Header Value Count	Number of repetitions of the same header	1
Form Value Count	Number of repetitions of the same form field	512
Parameter Pollution signatures (PHP Array Parameter Manipulation, PHP Settings Array Pollution, Nested Array Parameter Pollution)	Pollution with array syntax such as param[]=	While WAF is on
Duplicate key in JSON	-	No check

WAF scans all the parameter values in a request separately; in signature scanning, every value of the repeated parameters is inspected. When the value count limit is exceeded, a 24-point structural violation is written and the request is blocked in Blocking mode.

Solution: 2 Methods

For smuggling, the default behavior provides the protection; what needs to be done is not checking the RFC7230 option in the URL Normalization action unless it is needed (URL Normalization · Normalization). For parameter pollution, the repetition limit is narrowed on API endpoints; the methods write the same setting. Prerequisite: WAF is on in the vService (How do I enable WAF protection on a vService?) and there is a page type for the endpoint (How do I add a new page type manually?).

Your situation	Suitable method
I want to define it from the interface	Method 1: Query tab
I want to define it from the command line	Method 2: WEB-CLI

Method 1: Query Tab Recommended

• How it works The endpoint's Query common rule or the argument rule of a single parameter determines at most how many times the parameter can appear in a request.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → Query tab
• Requirement Modify permission in the WAF area; Structure Checks on in Checks; the host group in Monitor or Blocking mode
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Check the Checks settings

On the WAF Management tab, the pencil icon of the Checks card is clicked; the value count checks depend on the Structure Checks switch, and it must be checked. If a change was made, Edit is clicked.

2

Adım 2 Open the rule's Query tab

On the WAF Management tab, the N page types row under the mode card of the host group is clicked; the endpoint's rule is clicked and the Query tab is selected in the detail panel (accessing the screen).

3

Adım 3 Open the argument rule form

For a single parameter, Add Argument Rule for Query is clicked; if the same limit is wanted for all the parameters on the endpoint, Add Common Rule for Query (if the rule has its own Query check, Edit Common Rule for Query) is clicked.

4

Adım 4 Enter the repetition limit

In the argument rule, the parameter name (e.g. id) is written in the Argument Name field and Query Value Count = 1 is entered. If it is left empty, no repetition limit is applied; if 0 is entered, every use of the parameter is counted as a violation (Can I limit how many times the same parameter may repeat (Value count)?). The argument rule does not inherit that parameter's value checks from the common rule; the value length and pattern are also entered in this form.

5

Adım 5 Save

Add in the form is clicked; there is no separate deployment step. On endpoints with a form body, the same setting is made with Form Value Count on the Form tab. In a cluster, the change is sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1Repeated parameterMonitor mode · Event Logs

The parameter is sent twice and the Attacks tab of the Event Logs record is checked.

Command: curl -s -o /dev/null -w "%{http_code}\n" "https://api.example.com/api/v1/orders?id=100&id=200"

ExpectedQuery value count (24)

In Monitor mode, the request is passed; in Blocking mode, it is blocked. A request sent with a single id does not produce a violation.

Method 2: WEB-CLI

• How it works The parameter-specific argument rule is written with waf rule-parts add … loc query --arg <name>; --argMultiple is the repetition limit.
• Where it is opened WEB-CLI → waf rule-parts
• Requirement WEB-CLI access and modify permission in the WAF area; the vService, host group and rule IDs
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Get the IDs

The host group ID is read from the output of waf host-groups list poolId <vService>, and the rule ID from the output of the following command:

waf fw-rules list poolId <vService> hostGroupId <group>

2

Adım 2 Add the repetition limit

waf rule-parts add poolId <vService> hostGroupId <group> ruleId <rule> loc query --arg id --argMultiple 1

The command gives no output when it succeeds. The fields that are not written are saved with the schema defaults; the value length limit of the parameter becomes 0–1024, and for a parameter that carries a longer value, it is increased with --valueLength.val2.

Verification

1PartTR7 side

The parts of the rule are listed.

Command: waf rule-parts list poolId <vService> hostGroupId <group> ruleId <rule>

Expectedquery: id part

Common Mistakes

• Checking the RFC7230 option unnecessarily. The option is applied to all vService traffic independent of the condition field and also makes requests with conflicting framing be accepted; it is used only for mandatory compatibility with old clients and after the risk is assessed.
• Assuming that query repetition is blocked by default. In Any Paths, Query Value Count is 128; on API endpoints, it is lowered per parameter.
• Expecting a duplicate key check in the JSON body. There is no repetition limit field for JSON; with duplicate keys, the application's behavior depends on the application's JSON parser.
• Expecting the check to work in Learning mode. Value count checks are applied only in the Monitor and Blocking modes.
• Assuming that the 2-point smuggling signatures work at every level. The 2-point rules are loaded only at the Aggressive protection level.

How it is done in the documentation

• URL Normalization · RFC Compatibility Options (Backward Compatibility)
• Signature & Rule Library · Signature Categories
• Query · Query Value Count
• WEB-CLI · loc query — the query string

Related questions

• Can I limit how many times the same parameter may repeat (Value count)?
• Which attack categories do the signatures cover?
• If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?