How do I make sure only the query parameters I allow reach a page (Allowed Query Parameters)?

Short answer

In the common rule on the Query tab of the page type, the Allowed Query Parameters field is set to the Restrict position and the allowed parameter names are added one by one. Every different name that is not in the list produces a 24-point Allowed query parameters violation in the Structure Policies category; in Blocking mode the request is blocked, in Monitor mode it is only recorded. The matching is done with the raw (URL-encoded) form of the name, exactly and case-sensitively; defining an argument rule for a name does not add it to the list. For the inspection, Argument Checks must be on in the Checks window and the list must not exceed the Max. Allowed Arguments value (default 25); a list that exceeds it is not applied for that rule.

Problem: The Page Is Called with Unexpected Parameters

An endpoint accepts only certain parameters; requests that come with names other than these (parameter discovery, hidden parameter or debug flag attempts) should not reach the application. Signature scanning does not catch these requests, because the parameter name does not carry an attack pattern.

Solution: Two Methods

The two methods write the same setting; one of them is selected.

Your situation	Suitable method
I want to make the setting from the interface	Method 1: Query common rule
I want to do it with a script or the command line	Method 2: WEB-CLI

Method 1: Query Common Rule Recommended

• How it works An allowed name list is written to the Query section of the page type; every name that is not in the list counts as a violation.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → Query → Add Common Rule for Query
• RequirementArgument Checks on; the list not longer than the Max. Allowed Arguments value
• vService type WAF-enabled HTTP vService
• Area of effect Only the requests that match this page type; a list written to the Any paths rule is applied to all the paths that do not have their own Query rule

Step-by-Step Configuration

1

Adım 1 Open the Checks window (if needed)

Argument Checks comes on when WAF is turned on; if it has been turned off, in the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Checks card in the Inspection & Blocking section is clicked (Checks Edit screen).

2

Adım 2 Turn on Argument Checks

Argument Checks is turned on; the Max. Allowed Arguments field appears below it. If the list to be written is longer than this value, the value is increased (What is Max. Allowed Arguments for; what happens if a page's learned argument list exceeds this number?).

3

Adım 3 Save the Checks setting

Edit is clicked.

4

Adım 4 Open the Page Types list

On the WAF Management tab, the N page types row of the host group is clicked (accessing the Page Types screen).

5

Adım 5 Select the page type

The row of the page type is clicked in the list; the detail panel of the rule opens on the right (accessing the panel). If there is no page type, it is added first (How do I add a new page type manually?).

6

Adım 6 Open the Query tab

The Query tab is clicked in the tab strip of the panel.

7

Adım 7 Open the common rule form

Add Common Rule for Query above the table is clicked. If the rule already has its own Query common rule, the button appears as Edit Common Rule for Query (Add Common Rule for Query screen). The add form opens filled with the Query values of the Any paths rule; after the save, the rule does not take its Query values from Any paths.

8

Adım 8 Write the allowed names

The Allowed Query Parameters switch is set to the Restrict position and every name is added to the list as a separate item. The name is written in the raw form in which it appears in the request, paying attention to letter case (e.g. a%20b).

9

Adım 9 Save

Add (Edit when editing) is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually. To remove the restriction, the same field is set to the No Restriction position.

Verification

1Detail panelTR7 side

The Allowed Query Parameters row is checked in the Query tab of the rule.

ExpectedThe written names are listed with commas; there is no Rule source row

2Unauthorized parameterClient side

While the host group is in Blocking mode, a request is sent with a parameter that is not in the list.

Command: curl -s -o /dev/null -w "%{http_code}\n" "https://www.example.com/arama?debug=1"

Expected418

418 is the Blocking Status Code default; if it has been changed, the selected code is returned. In Monitor mode, the request passes.

3Event LogsTR7 side

On the Event Logs screen of the vService, the record is selected and the Attacks tab is checked.

ExpectedAttack area: Query@debug · Attack name: Allowed query parameters

Method 2: WEB-CLI

• How it works The list in Method 1 is written to the Query common part of the rule with WEB-CLI.
• Where it is opened WEB-CLI → waf rule-parts
• Requirement WEB-CLI access; Argument Checks on
• vService type WAF-enabled HTTP vService
• Pre-fill difference The add command writes the command defaults, not the Any paths values, to the fields that are not written

Step-by-Step Configuration

1

Adım 1 Turn on Argument checks (if needed)

waf options update poolId <vService> --syncWithDefaultFwRules false --argumentChecks true

2

Adım 2 Find the host group and rule IDs

The ID of the default host group is defaultHost. Rule IDs are listed in the id column and their paths in the description column (the Any paths rule appears as default rule):

waf fw-rules list poolId <vService> hostGroupId defaultHost

3

Adım 3 List the parts of the rule

The row that shows query: (all keys) in the description column is the Query common part of the rule:

waf rule-parts list poolId <vService> hostGroupId defaultHost ruleId <rule>

4

Adım 4 Add the Query common part if there is none

add writes the command defaults to the fields that are not written (e.g. queryKeyCount at most 16, querySize at most 8192, valueLength 0–1024); if the limits in Any paths are to be kept, these fields are also given in the command (loc query fields):

waf rule-parts add poolId <vService> hostGroupId defaultHost ruleId <rule> loc query --queryAllowedArgs.0 id --queryAllowedArgs.1 page

5

Adım 5 If there is a Query common part, see the existing list

In place of <part>, the ID from step 3 is written; the queryAllowedArgs.0, queryAllowedArgs.1 … lines in the output are the existing list:

waf rule-parts show poolId <vService> hostGroupId defaultHost ruleId <rule> <part>

6

Adım 6 Add the name to the first empty position

--queryAllowedArgs.N replaces the existing name at that position; the new name is written to the first empty position. If the list is empty, the position is 0; if there are two names, --queryAllowedArgs.2 is used:

waf rule-parts update poolId <vService> hostGroupId defaultHost ruleId <rule> id <part> --queryAllowedArgs.0 id

Verification

1Part recordTR7 side

The part is displayed again.

Command: waf rule-parts show poolId <vService> hostGroupId defaultHost ruleId <rule> <part>

ExpectedThe allowed names in the queryAllowedArgs lines

A request made with an unauthorized parameter is blocked as in Method 1.

Common Mistakes

• Writing the name in decoded form. The matching is done with the raw (URL-encoded) form of the name; a name that comes as a%20b in the request is also written to the list as a%20b.
• Writing the list to the Any paths rule. The Query common rule of the Any paths rule is applied to all the paths that do not have their own Query rule; the list is written only to the page type to be restricted.
• Taking the addition of an argument rule for an allowance. The argument rule inspects the value of the name; it does not add the name to the Allowed Query Parameters list.
• Writing a list longer than Max. allowed arguments. If the number of names in the list exceeds the Max. Allowed Arguments value, the list is not applied for that rule; the value is kept larger than the list (What is Max. Allowed Arguments for; what happens if a page's learned argument list exceeds this number?).
• Looking for the list while Argument checks is off. While the switch is off, the field is hidden in the form and in the panel, and the inspection is not applied either (What do the Structure Checks and Argument Checks master switches do; what happens if I turn them off?).
• Narrowing the limits with add in WEB-CLI. The add command does not fill in with the Any paths values; if fields such as the query size and the parameter count are not given in the command, they are written with the defaults.

How it is done in the documentation

• Query · Allowed Query Parameters
• Query · The Add Common Rule for Query Screen
• Checks · Max. Allowed Arguments
• WEB-CLI waf rule-parts · loc query — the query string

Related questions

• What is the difference between the negative security model (signature scanning) and the positive security model?
• Can I define required parameters (Required Query Parameters / Required Headers / Required Form Fields)?
• What is Max. Allowed Arguments for; what happens if a page's learned argument list exceeds this number?