Can I forbid JSON or XML bodies entirely on a page (Block All JSON Contents / Block All XML Contents)?

Short answer

Yes. When the Block All JSON Contents or Block All XML Contents box is checked in the common rule on the JSON or Xml tab of the page type, every request whose Content-Type declares that type and that carries a body produces a 24-point violation in the Structure Policies category without the body being parsed; for form bodies, there is Block All Form Contents on the Form tab. The box works independently of the main switches in the Checks window and is applied in the Blocking and Monitor modes. In the Any paths default, all three boxes are unchecked and the common rule form opened in the page type comes with this value. If Sync with Default WAF Rules is checked and saved while OWASP Protection Level is Aggressive, Any paths is rebuilt with the strict template and the three boxes come checked.

Problem: The Body Comes in an Unexpected Type

An XML body (XXE attempts) is sent to a path that accepts only form or JSON, or a JSON body to a path that does not expect JSON at all. A body type the application does not use is wanted to never reach that path.

Solution: Two Methods

The two methods set the same box; one of them is selected.

Your situation	Suitable method
I want to make the setting from the interface	Method 1: Block all box in the common rule
I want to do it with a script or the command line	Method 2: WEB-CLI

Method 1: Block All Box in the Common Rule Recommended

• How it works If Content-Type declares the JSON, XML or form type, a violation is written without the body being parsed.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → JSON / Xml / Form → Add Common Rule for …
• Requirement No main switch is required (it also works while Structure checks and Argument checks are off)
• vService type WAF-enabled HTTP vService
• Scope JSON: …/json and +json · Xml: …/xml and +xml · Form: application/x-www-form-urlencoded and multipart/form-data

Step-by-Step Configuration

1

Adım 1 Open the Page Types list

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the N page types row of the host group is clicked (accessing the Page Types screen).

2

Adım 2 Select the page type

The row of the page type on which the body type will be forbidden is clicked; the detail panel opens on the right (accessing the panel). If there is no page type, it is added first (How do I add a new page type manually?).

3

Adım 3 Open the tab

According to the type to be forbidden, the JSON, Xml or Form tab is clicked.

4

Adım 4 Open the common rule form

Add Common Rule for … above the table is clicked; if the rule has its own common rule, the button appears as Edit Common Rule for …. The add form opens filled with the values of the Any paths rule in that section (the box unchecked).

5

Adım 5 Check the box

The Block All JSON Contents (or Block All XML Contents, Block All Form Contents) box is checked.

6

Adım 6 Save

Add (Edit when editing) is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Forbidden body typeClient side

While the host group is in Blocking mode, a body of the forbidden type is sent.

Command: curl -s -o /dev/null -w "%{http_code}\n" -H "Content-Type: application/xml" -d "<a/>" https://www.example.com/upload

Expected418

418 is the Blocking Status Code default. In Monitor mode, the request passes and the violation is only recorded.

2Event LogsTR7 side

The Attacks tab of the Event Logs record is checked.

ExpectedAttack area: Xml · Attack name: Block all XML contents

Method 2: WEB-CLI

• How it works The box is written with WEB-CLI to the --jsonBlockAll, --xmlBlockAll or --formBlockAll field.
• Where it is opened WEB-CLI → waf rule-parts
• Requirement WEB-CLI access
• vService type WAF-enabled HTTP vService
• Pre-fill difference In the add command, the …BlockAll default is already on; the other fields are also written with the defaults of the command

Step-by-Step Configuration

1

Adım 1 Find the rule ID

The ID of the default host group is defaultHost; rule IDs are listed in the id column and their paths in the description column:

waf fw-rules list poolId <vService> hostGroupId defaultHost

2

Adım 2 List the parts of the rule

The row that shows xml: (all keys) in the description column is the Xml common part:

waf rule-parts list poolId <vService> hostGroupId defaultHost ruleId <rule>

3

Adım 3 Update the common part if it exists

waf rule-parts update poolId <vService> hostGroupId defaultHost ruleId <rule> id <part> --xmlBlockAll true

4

Adım 4 Add the common part if it does not exist

waf rule-parts add poolId <vService> hostGroupId defaultHost ruleId <rule> loc xml --xmlBlockAll true

Verification

1Part recordTR7 side

The part is displayed again.

Command: waf rule-parts show poolId <vService> hostGroupId defaultHost ruleId <rule> <part>

ExpectedxmlBlockAll true

Common Mistakes

• Checking the box in the Any paths rule. The Any paths rule is applied to all paths that do not have their own common rule for that section; all pages that accept bodies of that type are blocked. The box is checked only in the relevant page type.
• Rebuilding Any paths with Sync with default WAF rules at the Aggressive level. In the strict template, Block All … Contents is checked for JSON, Xml and Form; all bodies of these types that come to paths without their own common rule are blocked. On paths that accept bodies, the common rule of these sections is defined separately (Sync with Default WAF Rules).
• Expecting this box to catch a body that does not send Content-Type. The box reads the type from Content-Type; a body whose type is not declared is left to the inspections of the Raw tab (What does the Raw tab inspect; what happens to content that cannot be parsed?).
• Running add for another purpose in WEB-CLI and leaving the box on. In the add command, the …BlockAll default is on; when a JSON, Xml or Form part is added to a path that accepts bodies, it is turned off explicitly, as in --jsonBlockAll false.
• Confusing it with the method restriction. To restrict the method rather than the body, Allowed Methods is used (Can I allow only certain HTTP methods on a page (Allowed Methods)?).

How it is done in the documentation

• JSON · Block All JSON Contents
• XML · Block All XML Contents
• Form · Block All Form Contents
• OWASP Protection Level · Sync with Default WAF Rules

Related questions

• Can I block malformed (unparseable) JSON / XML / form bodies?
• What does the Raw tab inspect; what happens to content that cannot be parsed?
• Can I allow only certain HTTP methods on a page (Allowed Methods)?