Can I limit the total header / query size?

Short answer

Yes. Total Query Size in the Query common rule limits, in bytes, the whole raw query text excluding the ? sign (names, values, the & and = separators and repetitions included); Total Header Size in the Header common rule limits the total of all header lines excluding the request line. For Path, the counterpart is the Path Length field of the rule, and for bodies of every type, the Raw Body Size field on the Raw tab. Exceeding it is a 24-point violation in the Structure Limits category and depends on the Structure Checks switch in the Checks window. The Any paths default is 262144 bytes for Query and 65536 bytes for Header.

Problem: Requests Arrive with Inflated Query or Header Blocks

Requests that come with very long query strings or large header blocks lead to a risk of overflow and resource exhaustion in the application. Beyond the individual name or value limits, an upper limit is to be put on the total of the section.

Solution: Two Methods

The two methods write the same fields; one of them is selected.

Your situation	Suitable method
I want to make the setting from the interface	Method 1: Query and Header common rule
I want to do it with a script or the command line	Method 2: WEB-CLI

Method 1: Query and Header Common Rule Recommended

• How it works A total size limit is written to the common rule of the section; a request that exceeds the limit counts as a violation.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → Query / Header → Add Common Rule for …
• RequirementStructure Checks on
• vService type WAF-enabled HTTP vService
• Other sections The path total is limited with Path Length, and the body total with Raw Body Size; the JSON, Xml and Form tabs do not have a total size field

Field	Measured	Any paths default
Total Query Size	The byte length of the raw query text after ?	≤ 262144
Total Header Size	The total byte length of the header lines (name, value, line endings)	≤ 65536
Path Length	The length of the path (its decoded form if URL Decoding is on)	1–8192
Raw Body Size	The byte length of the request body; independent of the body type	1–268435456

Step-by-Step Configuration

1

Adım 1 Open the Checks window (if needed)

Structure Checks comes on when WAF is turned on; if it has been turned off, in the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Checks card in the Inspection & Blocking section is clicked (Checks Edit screen).

2

Adım 2 Turn on Structure Checks

Structure Checks is switched to the on position. While the switch is off, the total size fields are hidden in the form and in the panel.

3

Adım 3 Save the Checks setting

Edit is clicked.

4

Adım 4 Open the Page Types list

On the WAF Management tab, the N page types row of the host group is clicked (accessing the Page Types screen).

5

Adım 5 Select the page type

The row of the page type is clicked in the list; the detail panel of the rule opens on the right (accessing the panel).

6

Adım 6 Open the tab

The Query or Header tab is clicked.

7

Adım 7 Open the common rule form

Add Common Rule for Query (or … for Header) above the table is clicked; if the rule has its own common rule for that section, the button appears as Edit Common Rule for …. The add form opens filled with the values of the Any paths rule.

8

Adım 8 Enter the limit

For Total Query Size or Total Header Size, an operator and a byte value are selected (e.g. Less than or Equal to 4096). The Header limit is not chosen smaller than the total of the cookies and authorization headers that come to the page.

9

Adım 9 Save

Add (Edit when editing) is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Detail panelTR7 side

The total size row is checked in the Query or Header tab of the rule.

Expected≤ 4096

2Event LogsTR7 side

In Monitor or Blocking mode, a request that exceeds the limit is sent and the Attacks tab of the Event Logs record is checked.

ExpectedAttack name: Total query size; Description: something like 5000>4096

In Blocking mode, the Blocking Status Code (default 418) is returned to the client; in Monitor mode, the request passes.

Method 2: WEB-CLI

• How it works The limit is written to the --querySize or --headerSize fields with WEB-CLI.
• Where it is opened WEB-CLI → waf rule-parts
• Requirement WEB-CLI access; Structure Checks on (waf options update poolId <vService> --syncWithDefaultFwRules false --structureChecks true)
• vService type WAF-enabled HTTP vService
• Pre-fill differenceadd writes the command's defaults to the fields that are not written: in Query, querySize ≤ 8192, and in Header, headerSize ≤ 4096

Step-by-Step Configuration

1

Adım 1 Find the rule ID

The ID of the default host group is defaultHost; rule IDs are listed in the id column:

waf fw-rules list poolId <vService> hostGroupId defaultHost

2

Adım 2 List the parts of the rule

The row that shows query: (all keys) or header: (all keys) in the description column is the common part of the section:

waf rule-parts list poolId <vService> hostGroupId defaultHost ruleId <rule>

3

Adım 3 Update the common part if it exists

The operator is written in double quotes:

waf rule-parts update poolId <vService> hostGroupId defaultHost ruleId <rule> id <part> --querySize.op "<=" --querySize.val 4096

4

Adım 4 Add the common part if it does not exist

add also writes the command's defaults to the other fields that are not written (e.g. queryKeyCount ≤ 16, valueLength 0–1024); if these limits are not wanted, they are given in the command:

waf rule-parts add poolId <vService> hostGroupId defaultHost ruleId <rule> loc query --querySize.op "<=" --querySize.val 4096

Verification

1Part recordTR7 side

The part is displayed again.

Command: waf rule-parts show poolId <vService> hostGroupId defaultHost ruleId <rule> <part>

ExpectedThe new value in the querySize.op and querySize.val rows

Common Mistakes

• Keeping the Header total too small. Browser requests that carry large cookies and authorization headers are blocked; if the limit is written to the Any paths rule, all paths that do not have their own Header rule are affected.
• Adding the Header part in WEB-CLI with add. The add command writes the default of 4096 for headerSize; if the limit is not given in the command, requests with large headers can be blocked.
• Thinking that Raw body size is only for raw bodies. Raw Body Size is applied to bodies of every type (JSON, Xml and form included); the body size is limited with this field (What does the Raw tab inspect; what happens to content that cannot be parsed?).
• Confusing this limit with the body processing limit. Max. Body Size to Process(kB) determines the largest body size that can be parsed for inspection (a body that exceeds this size is not parsed) and is a separate setting (What is the maximum value of Max. body size to process; how does it relate to the log limit?).
• Counting the ? sign in the query size. The measurement is the raw text after ?; URL-encoded characters are counted in their encoded form (%20 is three bytes).

How it is done in the documentation

• Query · Total Query Size
• Header · Total Header Size
• Raw · Raw Body Size
• WEB-CLI waf rule-parts · loc header — the HTTP headers

Related questions

• Can I limit parameter name length and parameter count?
• What are the Path Length and Path Depth constraints for?
• What is the maximum value of Max. body size to process; how does it relate to the log limit?