What are the default header rules?

Short answer

When the host group is created, ready argument rules are added to the Header tab of the Any Paths rule for 21 frequently targeted headers: accept-encoding, connection, content-encoding, cookie, host, keep-alive, range, transfer-encoding, user-agent, x-forwarded-host, x-scanner, content-length, origin, upgrade, expect, authorization, sec-fetch-site, sec-fetch-mode, sec-fetch-dest, sec-fetch-user and referer (default header rules). Each of them carries a value pattern, length and repetition limit based on the RFCs; in the authorization and referer rules OWASP Check is off, and the presence of the x-scanner header is a violation by itself. The rules are inherited from Any paths. Changed or deleted rules are returned to their default definition with the Suggested Argument Settings button on the Header tab of the Any paths rule; this operation deletes the customizations on the 21 rules.

How Does It Work?

In every request, when one of these 21 headers comes, its value is inspected with the rule of that header; headers that have no rule are inspected with the Header common rule of the Any paths rule. Value inspections run while Structure Checks is on and in Blocking or Monitor mode; every violation is 24 points. The values of the headers whose OWASP check is on also go through signature scanning.

Header	Header Value Length	Header Value Pattern	Header Value Count	OWASP check
accept-encoding	≤ 128	List of encoding names (gzip, br, zstd, x-gzip …) and q values	1	On
connection	≤ 64	List of tokens such as keep-alive, close, upgrade, http2-settings	1	On
content-encoding	≤ 24	List of encoding names (identity included)	1	On
cookie	≥ 3	-	1	On
host	≥ 1	Domain name, IPv4 or IPv6 in square brackets, optional port	1	On
keep-alive	≤ 20	timeout= and max= pairs	1	On
range	≤ 128	List of ranges that starts with bytes=	10	On
transfer-encoding	≤ 20	List of transfer encodings such as chunked, gzip, identity	1	On
user-agent	≥ 1	-	1	On
x-forwarded-host	No restriction	Comma-separated host list	1	On
x-scanner	No restriction	-	0 (its presence is a violation)	On
content-length	≤ 16	Number of at most 15 digits	1	On
origin	≤ 256	null or a space-separated scheme://host[:port] list	1	On
upgrade	≤ 16	List of websocket, h2c, h2, webrtc, HTTP/x, TLS/x	1	On
expect	≤ 16	100-continue	1	On
authorization	≤ 32768	-	1	Off
sec-fetch-site	≤ 16	none, same-origin, same-site, cross-site	1	On
sec-fetch-mode	≤ 16	navigate, cors, no-cors, same-origin, websocket	1	On
sec-fetch-dest	≤ 32	Letters and hyphen	1	On
sec-fetch-user	≤ 4	?1	1	On
referer	≤ 4096	URL in the scheme://… form with RFC 3986 characters	1	Off

• The patterns are case-insensitive except for content-length and sec-fetch-user; Detailed Log is on in all 21 rules.
• Since the authorization (JWT and similar tokens) and referer (full URL) values are prone to producing false positives in signature scanning, OWASP Check is kept off in these two rules; for referer, a strict URL pattern is applied instead.
• The Header common rule of the Any paths rule is applied to the headers that are not in the list (Header Value Length 0–16384, Header Value Count 1, no pattern).

Default Header Rules in TR7

• Where it is seen: Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → Any paths row → Header tab; the rules are listed in bold in the variable table. On the Header tab of page types with an exact path, the same rules appear in italics (inherited).
• Learning: Header learning and teaching from Event Logs write the changes to the Any paths rule (except an Analysis & Learning applied with Combine With Old Rules); an OWASP exception can be added to these 21 rules or the length limit can be widened. When a pattern violation is taught, the pattern is not narrowed, it is cleared.
• Returning to the default definition (interface): On the Header tab of the Any paths rule, the Suggested Argument Settings button above the variable table is clicked and the Are you sure? question is confirmed. The 21 rules are rewritten with their default definitions and the missing ones are added; the other argument rules and the Header common rule do not change. The button appears only on the Header tab of the Any paths rule; the operation has no undo step.
• Returning to the default definition (WEB-CLI): For a single host group, waf fw-rules add-arg-headers <vService> <group> (both fields are written without names); waf host-groups add-arg-headers target all, on the other hand, applies it to all host groups of all WAF-enabled vServices (add-arg-headers, host-groups add-arg-headers).
• Cluster: The change is applied without a separate deployment step; with the default auto-sync, it is also sent to the peer device, and if Manual Sync Mode is on, it is sent to the peer device manually.

Common Misconceptions

• "cookie ≥ 3 and user-agent ≥ 1 make the header required." These rules only prevent the value from being empty or too short when the header comes; a request that does not send the header does not get a violation from these rules. The requirement is provided with the Required Headers list (Can I require a specific header to be present?).
• "Suggested argument settings only completes the missing rules." The button rewrites the 21 rules with their default definitions; the learned exceptions and manual changes on these rules are deleted.
• "On a page type that has its own Header common rule, these rules are not valid." The common rule ends the inheritance only for the common rule; the 21 header rules continue to be inherited unless a rule with the same name is defined in the page type (How do inheritance and "Rule Source" work in rules?).

How it is done in the documentation

• Header · Default Header Rules
• Header · Suggested Argument Settings
• WEB-CLI waf fw-rules · add-arg-headers — Adding the Recommended Header Rules

Related questions

• Which default settings are created when WAF is enabled?
• Are cookies scanned?
• How do I reset the rules to the default settings?