In multipart requests, is the whole body scanned separately as well?

Short answer

Yes. Even if the multipart form body is parsed successfully, as long as the Raw tab has OWASP Check on, the whole body goes through signature scanning as a single piece with the Raw settings (OWASP Exclusions and Detailed Log included). This scan ensures that unnamed or malformed parts that may be skipped during parsing are also inspected. It is separate from the scanning of field names and values in the Form tab with OWASP Check and from the scanning of file contents with OWASP Check in Upload; the three work together in the same request and the same signature is scored as a separate hit in each scan. In valid URL-encoded form, JSON and XML bodies, there is no additional whole-body scan. A multipart body that exceeds the processable size is not scanned; what happens to it is determined by Block Unparsed Contents.

How Does It Work?

In a multipart request that is parsed successfully, the signature scans are done in the following order:

#	Scan	With which setting	Attack area in the record
1	The whole body	Raw tab OWASP Check	Raw
2	The content of every uploaded file	Form tab OWASP Check in Upload and Raw tab OWASP Check (Is the content of uploaded files scanned as well (OWASP Check in Upload)?)	Raw@field-name
3	Field names and values (file names included)	Form tab OWASP Check	Form@field-name

• The same signature is scored as a separate hit in different scans; the total score is compared with the OWASP Protection Level threshold (If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?).
• If the multipart body cannot be parsed and Block Invalid Form Contents is not checked, the body still goes through Raw signature scanning as raw content (Can I block malformed (unparseable) JSON / XML / form bodies?).
• If OWASP Check is turned off in the Raw tab, neither the scanning of the whole body nor the scanning of the file contents is done.
• The processable size and Block Unparsed Contents: What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?

Common Misconceptions

• "If the body was parsed, the raw scan is unnecessary." Unnamed or malformed parts may not appear as fields during parsing; the scanning of the whole body also covers these bytes.
• "JSON bodies are also scanned raw separately." Valid JSON and XML bodies do not enter Raw signature scanning; they are scanned as raw content only when they cannot be parsed.
• "When OWASP check in upload is turned off, files are not scanned at all." If OWASP check is on in the Raw tab, the file bytes continue to be scanned together with the whole body.

How it is done in the documentation

• Form · What Is Form?
• Raw · What Is RAW?
• Form · OWASP Check in Upload

Related questions

• If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?
• Is the content of uploaded files scanned as well (OWASP Check in Upload)?
• What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?