What is Allowed Raw Body Mime Types used for?

Short answer

Allowed Raw Body Mime Types in the common rule of the Raw tab determines the allowed types of bodies whose Content-Type is not JSON, XML or form. The type is detected from the content of the body, not from the Content-Type the request declares; the list entries match the detected type as a substring and are written in lowercase. While the list is in the No restriction position, there is no restriction; a body that does not comply produces a 24-point violation in the Structure Policies category and the detected type appears in the record. The Any paths default is text/plain and application/octet-stream: plain text and binary data whose format is not recognized pass, and a body from whose content a specific type such as HTML, ZIP, PDF or a PHP script is derived produces a violation. The inspection works in the Blocking and Monitor modes and is independent of the main switches in the Checks window.

How Does It Work?

	Behavior
Bodies it is applied to	Bodies whose Content-Type is not JSON (…/json, +json), XML (…/xml, +xml) or form (application/x-www-form-urlencoded, multipart/form-data)
Bodies it is not applied to	Bodies that exceed the processable size (Block Unparsed Contents decides); bodies that declare JSON, XML or form and cannot be parsed (they enter only signature scanning)
Type detection	From the content; since there is no file name, text whose format is not recognized is detected as text/plain, and unrecognized binary data as application/octet-stream (Does the file type check look at the client's Content-Type or at the file's content?)
Matching	The list entry is searched for within the detected type; the text/plain entry does not cover text/html, the text entry does
Violation	Allowed raw body mime types, Structure Policies, 24 points; the detected type in the Description field of the Event Logs record

Configuring in TR7

1. In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the N page types row of the host group is clicked.
2. The row of the page type is clicked; the detail panel opens on the right.
3. The Raw tab is clicked.
4. Add Common Rule for Raw (Edit Common Rule for Raw if the rule has its own Raw common rule) is clicked; the form opens with the Raw values of the Any paths rule.
5. The Allowed Raw Body Mime Types list is edited in the Restrict position; each type is added as a separate item (e.g. application/pdf).
6. Add (Edit when editing) is clicked; the change is applied without a separate deployment step and, in a cluster setup, is sent to the peer device with the default auto-sync (manually if Manual Sync Mode is on).

In WEB-CLI, the field is named rawAllowedMimeTypes (loc raw). The ID of the Any paths rule is wr-default, and the ID of its Raw common part is default_raw. --rawAllowedMimeTypes.N replaces the existing type at that position; the existing list is seen with waf rule-parts show poolId <vService> hostGroupId defaultHost ruleId wr-default default_raw and the new type is written to the first empty position. If the list carries the two default types, the third type is added to position .2:

waf rule-parts update poolId <vService> hostGroupId defaultHost ruleId wr-default id default_raw --rawAllowedMimeTypes.2 application/pdf

For verification, in the Monitor or Blocking mode, a body that starts with <html> is sent with the Content-Type: text/plain header; the Allowed raw body mime types violation appears in the Event Logs record and text/html in the Description field.

Common Misconceptions

• "I restrict the JSON body with this list." The list is not applied to bodies whose Content-Type is JSON, XML or form; if the body type is to be prohibited, Block All … Contents is used (Can I forbid JSON or XML bodies entirely on a page (Block All JSON Contents / Block All XML Contents)?).
• "Writing text is safe." Because of substring matching, the text entry also lets the text/html and text/x-shellscript types through; the full type is written.
• "This list also covers file uploads." Multipart form uploads are inspected with Allowed Upload Mime Types in the Form tab (Can I allow only certain MIME types in file uploads?).

How it is done in the documentation

• Raw · Allowed Raw Body Mime Types
• Raw · What Is RAW?
• WEB-CLI waf rule-parts · loc raw — the raw body

Related questions

• Does the file type check look at the client's Content-Type or at the file's content?
• What does the Raw tab inspect; what happens to content that cannot be parsed?
• Can I allow only certain MIME types in file uploads?