Can I limit parameter name length and parameter count?

Short answer

Yes. In the common rule of the Query, Header, JSON, Xml and Form tabs, the … key length field restricts the length of a single name (key), and the … key count field restricts the number of names (Query Key Length, Query Key Count); No Restriction, Less than or Equal to, Equals to, Greater than or Equal to or Range is selected as the operator. In Query, Header and Form, each distinct name is counted once; in JSON and Xml, key count is the number of leaf values in the body, and each element of an array is counted separately. The length is the byte count of the raw form of the name. Every violation is 24 points in the Structure Limits category and depends on the Structure Checks switch in the Checks window. For Path, the counterparts are the Path Length and Path Depth fields of the rule.

Problem: Excessively Long or Very Many Parameter Names Arrive

Requests with unusually long parameter names or with hundreds of parameters come to a page (overflow attempts, parameter pollution, resource exhaustion). If the name length and the number of names the application actually uses are known, the requests outside these are to be rejected.

Solution: Two Methods

The two methods write the same fields; one of them is selected.

Your situation	Suitable method
I want to make the setting from the interface	Method 1: Key length and key count in the common rule
I want to do it with a script or the command line	Method 2: WEB-CLI

Method 1: Key Length and Key Count in the Common Rule Recommended

• How it works The name length and name count restrictions are written to the common rule of the section; every name or request that does not comply with the restriction counts as a violation.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → tab → Add Common Rule for …
• RequirementStructure Checks on
• vService type WAF-enabled HTTP vService
• Area of effect Only the requests that match this page type; the values in the Any paths rule are applied to all paths that do not have their own common rule for that section

Measurement by section and the default values of the Any paths rule (Query, JSON):

Tab	What key length measures	What key count counts	Any paths default (length · count)
Query	The raw (URL-encoded) length of each distinct parameter name	The number of distinct parameter names	0–16384 · ≤ 1024
Header	The length of each distinct header name	The number of distinct header names	1–128 · ≤ 128
JSON	The length of each distinct object key	The number of leaf values (array elements included)	0–1024 · ≤ 65536
Xml	The length of each distinct element and attribute name	The number of leaf values	1–128 · ≤ 4096
Form	The length of each distinct field name	The number of distinct field names	0–524288 · ≤ 512

The defaults are the template written when the host group is created; learning and manual changes change these values.

Step-by-Step Configuration

1

Adım 1 Open the Checks window (if needed)

Structure Checks comes on when WAF is turned on; if it has been turned off, in the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Checks card in the Inspection & Blocking section is clicked (Checks Edit screen).

2

Adım 2 Turn on Structure Checks

Structure Checks is switched to the on position. While the switch is off, the key length and key count fields are hidden in the form and in the panel.

3

Adım 3 Save the Checks setting

Edit is clicked.

4

Adım 4 Open the Page Types list

On the WAF Management tab, the N page types row of the host group is clicked (accessing the Page Types screen).

5

Adım 5 Select the page type

The row of the page type is clicked in the list; the detail panel of the rule opens on the right (accessing the panel). If there is no page type, it is added first (How do I add a new page type manually?).

6

Adım 6 Open the tab

The tab of the section to be restricted (Query, Header, JSON, Xml or Form) is clicked.

7

Adım 7 Open the common rule form

Add Common Rule for … above the table is clicked; if the rule has its own common rule for that section, the button appears as Edit Common Rule for … (Add Common Rule for Query screen). The add form opens filled with the values of the Any paths rule in that section.

8

Adım 8 Enter the restrictions

For … key length (e.g. Query Key Length), an operator and a value are selected; when Range is selected, two values are entered and the limits are inclusive. For … key count, an operator and a value are also selected. For an upper limit, Less than or Equal to is used; Equals to requires exact equality. Only numbers can be entered in the fields.

9

Adım 9 Save

Add (Edit when editing) is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

The path length and depth are the page type's own fields; in rules with a glob path and in the Any paths rule, they are entered from the Add / Edit form, and the form of rules with an exact path does not have these fields (What are the Path Length and Path Depth constraints for?).

Verification

1Detail panelTR7 side

The … key length and … key count rows are checked in the related tab of the rule.

ExpectedThe entered restrictions, such as [1 - 64] and ≤ 10

2Event LogsTR7 side

In Monitor or Blocking mode, a request that exceeds the limit is sent and the Attacks tab of the Event Logs record is checked.

ExpectedAttack name: Query key count; Description: 11>10

In Blocking mode, the Blocking Status Code (default 418) is returned to the client; in Monitor mode, the request passes.

Method 2: WEB-CLI

• How it works The restrictions are written to the common part of the rule with WEB-CLI using the .op, .val and .val2 fields.
• Where it is opened WEB-CLI → waf rule-parts
• Requirement WEB-CLI access; Structure Checks on (waf options update poolId <vService> --syncWithDefaultFwRules false --structureChecks true)
• vService type WAF-enabled HTTP vService
• Pre-fill difference The add command writes the command defaults, not the Any paths values, to the fields that are not written

Step-by-Step Configuration

1

Adım 1 Find the rule ID

The ID of the default host group is defaultHost; rule IDs are listed in the id column:

waf fw-rules list poolId <vService> hostGroupId defaultHost

2

Adım 2 List the parts of the rule

The row that shows query: (all keys) in the description column is the Query common part:

waf rule-parts list poolId <vService> hostGroupId defaultHost ruleId <rule>

3

Adım 3 Update the common part if it exists

The operators (<=, =, >=, -) are written in double quotes; for the - range, .val2 is also given (loc query fields):

waf rule-parts update poolId <vService> hostGroupId defaultHost ruleId <rule> id <part> --queryKeyLength.op "-" --queryKeyLength.val 1 --queryKeyLength.val2 64 --queryKeyCount.op "<=" --queryKeyCount.val 10

4

Adım 4 Add the common part if it does not exist

add writes the command's defaults to the fields that are not written (in Query, querySize at most 8192 and valueLength 0–1024; in JSON, Xml and Form, …BlockAll on). When a JSON, Xml or Form part is added, --jsonBlockAll false (or --xmlBlockAll false, --formBlockAll false) is given so that all bodies are not blocked:

waf rule-parts add poolId <vService> hostGroupId defaultHost ruleId <rule> loc json --jsonBlockAll false --jsonKeyCount.op "<=" --jsonKeyCount.val 200

Verification

1Part recordTR7 side

The part is displayed again.

Command: waf rule-parts show poolId <vService> hostGroupId defaultHost ruleId <rule> <part>

ExpectedNew values in the queryKeyLength.op, .val, .val2 and queryKeyCount rows

Common Mistakes

• Thinking that Equals to means "at most". Equals to requires exact equality; every name of a different length counts as a violation. For an upper limit, Less than or Equal to is selected.
• Writing a strict key count in the Any paths rule. The Any paths values affect all paths that do not have their own common rule for that section; a strict limit is written to the page type.
• Thinking that JSON key count is the number of keys. In JSON and Xml, leaf values are counted; the {"ids":[1,2,3]} body counts as 3 (Can I allow only specific keys in JSON; how are nested key paths written?).
• Looking for a repeated parameter in key count. id=1&id=2 counts as a single name; the number of repetitions of the same name is limited with the … value count field (Can I limit how many times the same parameter may repeat (Value count)?).
• Adding the JSON part in WEB-CLI with add using the defaults. The jsonBlockAll default is on; if --jsonBlockAll false is not given in the command, all JSON bodies that come to the page are blocked.

How it is done in the documentation

• Query · Query Key Length
• Query · Query Key Count
• JSON · JSON Key Count
• WEB-CLI waf rule-parts · The Field Families According to the Regions

Related questions

• What are the Path Length and Path Depth constraints for?
• Can I limit the total header / query size?
• What do the Structure Checks and Argument Checks master switches do; what happens if I turn them off?