What does a blocked user see?

Short answer

While the host group is in Blocking mode, a request blocked by WAF is not forwarded to the Backend Service; the blocking response produced by TR7 is returned to the client. In Monitor and Learning modes, WAF does not block the request. When WAF is turned on, the response is TR7's built-in blocking page with the 418 status code and the text/html type: the Your Access To This Page Has Been Blocked! title is in the middle, the Request ID and IP Address rows are below it, and the time of the request is at the top right. The Request ID is the unique identifier of the request, and the record is found in Event Logs with the Request Unique ID field. The content, the content type and the status code are changed from the Blocking Page window.

How Does It Work?

A request is blocked and receives the blocking response in the following situations:

Situation	Mode
The accumulated attack score reached the OWASP Protection Level threshold (a single structural violation is 24 points and is enough at every level)	Blocking
The source IP is on the blacklist (Blacklist Protection; 100 points)	Blocking
The WAF scan could not be completed within the time limit; the request is blocked so that an uninspected request does not reach the Backend Service. While Fail-open in the Request Body Limits window is on, these requests are let through without being scanned (What happens to a request if the scan exceeds a certain time (2-second scan limit)?)	Blocking

The parts of the response:

Part	Value when WAF is turned on	Where it is changed
Status code	418	Blocking Status Code (Why is the 418 status code returned by default on a block; can I change it?)
Content	Built-in English blocking page (the same content as the WAF Blocking Page (English) profile)	Blocking Page Source (Can I change the blocking page?)
Content type	text/html; charset=utf-8	Blocking Page Content Type or the type of the selected content profile
Values on the page	%TIME (time), %UID (Request ID), %SRCIP (client IP)	Smart Variables (Which Smart Variables can I use on the blocking page (%UID, %SRCIP, %WAFSCORE, %WAFINFO …); is it safe to show attack details?)
Different page depending on a condition	None	Conditional Blocking Pages (Can I define different blocking pages depending on conditions (Conditional Blocking Pages)?)

The response is the same for the browser and the API client; to return a JSON body to API clients, a conditional page or the JSON template is used (Can I return a JSON blocking response instead of HTML for API clients?).

Blocking Response in TR7

• Where it is seen: The Blocking page card in the Inspection & Blocking section of Left Monitor Panel → WAF-Protected vServices → vService → WAF Management summarizes the response in a single sentence; when WAF is turned on, it reads A blocked client gets the inline content (text/html) with status 418 (Blocking page card).
• Record: The blocked request appears on the Event Logs screen of the vService with the Attack blocked decision; the record is found by writing the Request ID passed on by the user into the Request Unique ID field in the server filter. Requests blocked because their scan could not be completed within the time limit are not written to Event Logs.
• Scope: The blocking response settings apply across the vService and are common to all host groups. The quarantine, access denial and CAPTCHA pages are independent of this setting.

Common Misconceptions

• "The blocking page is returned in Monitor mode as well." In Monitor mode, the request is let through and the attack is only recorded; the page is returned only in Blocking mode.
• "The 418 response is produced by the browser or the application." The response is produced by TR7; the request is never forwarded to the Backend Service.
• "The blocking page is set separately for each host group." The setting applies across the vService; different pages for different requests are defined with conditional blocking pages.

How it is done in the documentation

• Blocking Page · What Is Blocking Page?
• Blocking Page · The Blocking Page Card on WAF Management
• Event Logs · Request Unique ID

Related questions

• Can I change the blocking page?
• Why is the 418 status code returned by default on a block; can I change it?
• My users are getting a "418" error; what is happening?