What is the Raw inspection order?

Short answer

A request that carries a body goes through three stages in terms of Raw after the path, query and header inspections (runtime RAW inspection order). Size: Raw Body Size is applied independently of the body type, before the other body inspections. Processability: if the body exceeds the processable size or was not completed in time, Block Unparsed Contents writes a violation or passes the body without inspecting it; no other body inspection is done on these bodies. Content: in bodies whose Content-Type is not JSON, XML or form, the Allowed Raw Body Mime Types inspection and the signature scanning of the whole body are done. Successfully parsed JSON, XML and urlencoded form bodies do not enter Raw signature scanning; multipart bodies are scanned separately even if they are parsed; JSON and XML bodies that cannot be parsed in the type they declare, and form bodies that cannot be parsed while Block Invalid Form Contents is not checked, go only through Raw signature scanning.

How Does It Work?

#	Stage	What happens
1	Size	The Raw Body Size restriction is applied in every request with a body (while Structure Checks is on)
2	Processability	If the body exceeds the processable size or was not completed in time, Block Unparsed Contents decides; the body inspections end here (What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?)
3	Content	According to the Content-Type, the inspections of the JSON, Xml or Form tab; in other types, Allowed Raw Body Mime Types and Raw signature scanning

Which bodies the inspections of the Raw tab are applied to in the third stage:

Body	Allowed Raw Body Mime Types	Raw signature scanning
Valid JSON or XML	No	No
Valid application/x-www-form-urlencoded	No	No
Valid multipart/form-data	No	Yes, the whole body and also each file (In multipart requests, is the whole body scanned separately as well?)
JSON, XML or form that cannot be parsed in the type it declares	No	Yes, as raw content; in a form body, no if Block Invalid Form Contents is checked (Can I block malformed (unparseable) JSON / XML / form bodies?)
Other content types (e.g. text/plain, application/octet-stream)	Yes (in the Blocking and Monitor modes)	Yes

• Raw signature scanning is done while OWASP Check in the Raw tab is on; the OWASP Exclusions and Detailed Log settings are also read from the Raw tab.
• If an unexpected error occurs at any stage, the Block Unexpected Parser Errors setting comes into play.
• In the Learning mode, no stage blocks the request and the violations found are not added to the score; the type inspection is not done in this mode, and signature scanning is done for the learning record.
• The order of all sections of the request: Which stages does a request go through inside TR7 WAF?

Common Misconceptions

• "Raw body size is measured only for bodies of the Raw type." It is measured in all requests with a body, independently of the body type.
• "In a body that exceeds the processable size, at least the type inspection is done." The decision is made in stage 2; stage 3 is not reached.
• "A JSON body that cannot be parsed gets caught by the Allowed raw body mime types list." These bodies enter only signature scanning; the type inspection is applied to bodies whose Content-Type is not JSON, XML or form.

How it is done in the documentation

• Raw · Runtime: The RAW Inspection Order
• Raw · Raw Body Size
• WAF · How Does It Work?

Related questions

• Which stages does a request go through inside TR7 WAF?
• What does the Raw tab inspect; what happens to content that cannot be parsed?
• What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?