Can I require a specific header to be present?

Q: Can I require a specific header to be present?

Yes. In the common rule on the Header tab of the page type, the Required Headers list is set to the Restrict position and the header name is added; every request that does not carry the header produces a 24-point Required Headers violation in the Structure Policies category. The presence of the header is enough, its value can be empty; the format of the value is inspected separately with Header Value Pattern in the argument rule opened for that header. Headers are compared after being lowercased and the list entries are not converted; the name is written in lowercase, such as x-api-key. For the inspection, Argument Checks must be on in the Checks window. Learning and teaching write header changes to the Any Paths rule (except an Analysis & Learning applied with Combine With Old Rules); a path-specific Header rule is edited manually.

Short answer

Yes. In the common rule on the Header tab of the page type, the Required Headers list is set to the Restrict position and the header name is added; every request that does not carry the header produces a 24-point Required headers violation in the Structure Policies category. The presence of the header is enough, its value can be empty; the format of the value is inspected separately with Header Value Pattern in the argument rule opened for that header. Headers are compared after being lowercased and the list entries are not converted; the name is written in lowercase, such as x-api-key. For the inspection, Argument Checks must be on in the Checks window. Learning and teaching write header changes to the Any Paths rule (except an Analysis & Learning applied with Combine With Old Rules); a path-specific Header rule is edited manually.

Problem: Requests That Come Without a Header Reach the Application

An API path should be called only with a specific header (e.g. an API key or the client version); if the header is missing, the request should be rejected before it reaches the application. Not only the presence of the header but also the format of its value may need to be inspected.

Solution: Two Methods

The two methods write the same list; one of them is selected. If the format of the value will also be inspected, the additional step in Method 1 is applied.

Your situation	Suitable method
I want to make the setting from the interface	Method 1: Header common rule
I want to do it with a script or the command line	Method 2: WEB-CLI

Method 1: Header Common Rule Recommended

How it works The required header name is written to the Header common rule of the page type; a request that does not carry the header counts as a violation.
Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → Header → Add Common Rule for Header
RequirementArgument Checks on; for the value format, Structure Checks on as well
vService type WAF-enabled HTTP vService
Relation to learning Learning and teaching write header changes to the Any paths rule; only an Analysis & Learning applied with Combine With Old Rules can widen a path-specific Header rule

Step-by-Step Configuration

Adım 1 Open the Checks window (if needed)

Argument Checks comes on when WAF is turned on; if it has been turned off, in the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Checks card in the Inspection & Blocking section is clicked (Checks Edit screen).

Adım 2 Turn on Argument Checks

Argument Checks is turned on.

Adım 3 Save the Checks setting

Edit is clicked.

Adım 4 Open the Page Types list

On the WAF Management tab, the N page types row of the host group is clicked (accessing the Page Types screen).

Adım 5 Select the page type

The row of the page type the requirement will be applied to is clicked; the detail panel opens on the right (accessing the panel). If there is no page type, it is added first (e.g. with the /api/** glob path) (How do I add a new page type manually?).

Adım 6 Open the Header tab

The Header tab in the tab strip of the panel is clicked.

Adım 7 Open the common rule form

Add Common Rule for Header above the table is clicked; if the rule has its own Header common rule, the button appears as Edit Common Rule for Header (Add Common Rule for Header screen). The add form opens filled with the Header values of the Any paths rule.

Adım 8 Write the header name

The Required Headers switch is set to the Restrict position and the header name is added in lowercase (x-api-key).

Adım 9 Save

Add (Edit when editing) is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Adım 10 Inspect the format of the value (optional)

In the same tab, Add Argument Rule for Header above the variable table is clicked; the header name is written in lowercase in the Argument Name box and the expected format is entered in the Header Value Pattern field (e.g. ^[A-Za-z0-9]{32}$). The form is saved with Add. This inspection depends on the Structure Checks switch (Can I restrict a parameter's value by length or regex pattern (Value length / Value pattern)?).

Verification

1Request without the headerClient side

While the host group is in Blocking mode, a request is sent without the header.

Command: curl -s -o /dev/null -w "%{http_code}\n" https://www.example.com/api/rapor

Expected418

When the same request is sent with -H "X-Api-Key: …", the response of the application returns; the letter case the client writes does not matter. 418 is the Blocking Status Code default.

2Event LogsTR7 side

The Attacks tab of the Event Logs record is checked.

ExpectedAttack area: Header@x-api-key · Attack name: Required headers

Method 2: WEB-CLI

How it works The header name is written with WEB-CLI to the headerMustArgs list in the Header common part of the rule.
Where it is opened WEB-CLI → waf rule-parts
Requirement WEB-CLI access; Argument Checks on (waf options update poolId <vService> --syncWithDefaultFwRules false --argumentChecks true)
vService type WAF-enabled HTTP vService
Pre-fill differenceadd writes the defaults of the command to the fields that are not written (headerSize ≤ 4096, headerKeyCount ≤ 32, valueLength 0–1024)

Step-by-Step Configuration

Adım 1 Find the rule ID

The ID of the default host group is defaultHost; rule IDs are listed in the id column:

text

waf fw-rules list poolId <vService> hostGroupId defaultHost

Adım 2 List the parts of the rule

The line that shows header: (all keys) in the description column is the Header common part:

text

waf rule-parts list poolId <vService> hostGroupId defaultHost ruleId <rule>

Adım 3 If there is a common part, see the existing list

The headerMustArgs.0, headerMustArgs.1 … lines in the output are the current required headers:

text

waf rule-parts show poolId <vService> hostGroupId defaultHost ruleId <rule> <part>

Adım 4 Write the name to the first empty position

--headerMustArgs.N replaces the existing name at that position; the new name is written to the first empty position (0 if the list is empty):

text

waf rule-parts update poolId <vService> hostGroupId defaultHost ruleId <rule> id <part> --headerMustArgs.0 x-api-key

Adım 5 Add the common part if it does not exist

So that requests with large headers are not blocked, the total size limit is given in the command:

text

waf rule-parts add poolId <vService> hostGroupId defaultHost ruleId <rule> loc header --headerSize.op "<=" --headerSize.val 65536 --headerMustArgs.0 x-api-key

Verification

1Part recordTR7 side

The part is displayed again.

Command: waf rule-parts show poolId <vService> hostGroupId defaultHost ruleId <rule> <part>

Expectedx-api-key in the headerMustArgs line

A request without the header is blocked as in Method 1.

Common Mistakes

Writing the name in uppercase. List entries are not converted to lowercase; if X-Api-Key is written, the requirement is not met in any request and every request produces a violation.
Putting the requirement in the Any paths rule. The Header common rule of the Any paths rule is applied to all paths that do not have their own Header rule; browser and monitoring requests that do not carry the header are also blocked. The requirement is written only to the relevant page type.
Looking for the requirement in the argument rule. The argument rule inspects the value of the header, not its presence; if the header does not come, the argument rule does not run at all.
Expecting the path-specific Header rule to loosen with learning. Header learning is written to the Any paths rule (only an Analysis & Learning applied with Combine With Old Rules can widen the page type's own Header rule); violations that come from the page type's own Header common rule are resolved by editing that rule manually.

How it is done in the documentation

Can I require a specific header to be present? ​

Problem: Requests That Come Without a Header Reach the Application ​

Solution: Two Methods ​

Method 1: Header Common Rule Recommended ​

Step-by-Step Configuration ​

Verification ​

Method 2: WEB-CLI ​

Step-by-Step Configuration ​

Verification ​

Common Mistakes ​

Can I require a specific header to be present?

Problem: Requests That Come Without a Header Reach the Application

Solution: Two Methods

Method 1: Header Common Rule Recommended

Step-by-Step Configuration

Verification

Method 2: WEB-CLI

Step-by-Step Configuration

Verification

Common Mistakes