Can I limit how many times the same parameter may repeat (Value count)?

Short answer

Yes. The … value count field on the Query, Header and Form tabs (Query Value Count, Header Value Count, Form Value Count) defines at most how many times the same name can occur in a request; it takes an integer between 0 and 1000000, if it is left empty there is no repetition limit, and if 0 is entered, even a single occurrence of the name is a violation. In the common rule, the field is applied to all names that do not have their own argument rule, and in the argument rule, only to that name. Exceeding the limit is a 24-point violation in the Structure Limits category. In Header, each header line, and in Form, each value and file that comes with the same name counts as one repetition. The JSON and Xml sections do not have this field. The Any paths default is 128 for Query, 1 for Header and 512 for Form.

Problem: The Same Parameter Repeats in the Request

Parameter pollution (?id=1&id=2) or sending the same header with more than one line can cause the application and the components in front of it to read different values. The number of times a name can occur in the request is to be limited.

Solution: Two Methods

The two methods write the same field; one of them is selected.

Your situation	Suitable method
I want to make the setting from the interface	Method 1: … value count field
I want to do it with a script or the command line	Method 2: WEB-CLI

Method 1: … Value Count Field Recommended

• How it works The number of values of the name in the request is compared with the limit in the field; every name that exceeds the limit counts as a separate violation.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → Query / Header / Form → Add Argument Rule for … or Add Common Rule for …
• RequirementStructure Checks on
• vService type WAF-enabled HTTP vService
• Any paths defaults Query common rule 128, Header common rule 1, Form common rule 512; 1 in the default header rules (range 10, x-scanner 0)

Step-by-Step Configuration

1

Adım 1 Open the Checks window (if needed)

Structure Checks comes on when WAF is turned on; if it has been turned off, in the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Checks card in the Inspection & Blocking section is clicked (Checks Edit screen).

2

Adım 2 Turn on Structure Checks

Structure Checks is switched to the on position. While the switch is off, the … value count field is hidden in the form and in the panel.

3

Adım 3 Save the Checks setting

Edit is clicked.

4

Adım 4 Open the Page Types list

On the WAF Management tab, the N page types row of the host group is clicked (accessing the Page Types screen).

5

Adım 5 Select the page type

The row of the page type is clicked in the list; the detail panel of the rule opens on the right (accessing the panel).

6

Adım 6 Open the tab

The Query, Header or Form tab is clicked.

7

Adım 7 Open the form

For a single name, Add Argument Rule for … above the variable table is clicked; for all names in the section, Add Common Rule for … (Edit Common Rule for … if the rule has its own common rule) is clicked.

8

Adım 8 Enter the name and the limit

In the argument rule, the name is written in the Argument Name box (e.g. id; in Header, the header name is written in lowercase). An integer is entered in the … value count field (e.g. 1). In the argument rule, the other value fields in the form also apply to this name; a field left empty means no restriction for that inspection.

9

Adım 9 Save

Add (Edit when editing) is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Repeated parameterClient side

While the host group is in Blocking mode, the name is sent twice.

Command: curl -s -o /dev/null -w "%{http_code}\n" "https://www.example.com/urun?id=1&id=2"

Expected418

418 is the Blocking Status Code default. In Monitor mode, the request passes and the violation is only recorded.

2Event LogsTR7 side

The Attacks tab of the Event Logs record is checked.

ExpectedAttack area: Query@id · Attack name: Query value count; Description: 2>1

Method 2: WEB-CLI

• How it works The limit is written to the --argMultiple field with WEB-CLI.
• Where it is opened WEB-CLI → waf rule-parts
• Requirement WEB-CLI access; Structure Checks on (waf options update poolId <vService> --syncWithDefaultFwRules false --structureChecks true)
• vService type WAF-enabled HTTP vService
• Pre-fill differenceadd writes the command's defaults, not the Any paths values, to the fields that are not written (valueLength 0–1024, argOwasp on)

Step-by-Step Configuration

1

Adım 1 Find the rule ID

The ID of the default host group is defaultHost; rule IDs are listed in the id column:

waf fw-rules list poolId <vService> hostGroupId defaultHost

2

Adım 2 Add the argument rule

If there is a rule with the same name, the command is rejected; in that case, the ID of the part is found with waf rule-parts list and update … id <part> --argMultiple 1 is used:

waf rule-parts add poolId <vService> hostGroupId defaultHost ruleId <rule> loc query --arg id --argMultiple 1

Verification

1Part listTR7 side

The parts of the rule are listed.

Command: waf rule-parts list poolId <vService> hostGroupId defaultHost ruleId <rule>

Expectedquery: id

A request made with a repeated parameter is blocked as in Method 1.

Common Mistakes

• Thinking that 0 means "no restriction". 0 requires the name not to be present in the request at all; if the repetition limit is to be removed, the field is left empty.
• Forgetting the Header limit of the Any paths rule. In the Header common rule of the Any paths rule, the limit is 1; a header that does not have its own argument rule produces a violation if it comes in two lines. For a header that legitimately repeats, an argument rule is opened for that header and the limit is raised.
• Looking for a repetition limit in JSON. The JSON and Xml sections do not have the … value count field; the array length is limited with JSON Key Count (Can I limit parameter name length and parameter count?).

How it is done in the documentation

• Query · Query Value Count
• Header · Header Value Count
• Form · Form Value Count
• WEB-CLI waf rule-parts · The Fields Common to Every Region

Related questions

• Can I restrict a parameter's value by length or regex pattern (Value length / Value pattern)?
• What are the default header rules?
• Can I limit parameter name length and parameter count?