Which Smart Variables can I use on the blocking page (%UID, %SRCIP, %WAFSCORE, %WAFINFO …); is it safe to show attack details?

Short answer

On the blocking page, all the HTTP Smart Variables that can be used at the request stage can be used; the variables are written to the Blocking Page field or to the Content Pages profile and appear as badges in the visual editor. The WAF-specific ones: %WAFSCORE (total attack score), %WAFINFO (attack details JSON), %ISWAFATTACK and %ISWAFBLOCKED. The most used on blocking pages are the %UID (the unique ID of the request; the Event Logs field Request Unique ID), %SRCIP (the client IP) and %TIME (the request time) variables. %UID, %TIME and %SRCIP can be shown to the external user. Since %WAFINFO shows the client the ID of the signatures that caught the request, the attack area, the score and, depending on the setting, the caught value, it is not used on a page open to external users; if needed, it is used only on a conditional page specific to the internal network. The %WAFINFO content is determined by the settings in the SIEM & Attack Details card.

Blocking Page Variables

Variable	What it writes	Showing it to the external user
%UID	The unique ID of the request; the record is found in Event Logs with the Request Unique ID field (How do I find a specific request by its Request Unique ID?)	Can be shown; recommended for support requests
%TIME	The time of the request	Can be shown
%SRCIP	The IP of the client; if Trusted proxy is defined on the vService, the client address reported by the proxy	Can be shown
%WAFSCORE	The total attack score accumulated in the request	Not recommended: it shows how close the score is to the blocking threshold
%ISWAFATTACK · %ISWAFBLOCKED	Was an attack found · was the request blocked	Carries no information on the blocking page
%WAFINFO	JSON: uid, totalScore, action (block / monitor / fpc), the attacks list (for each attack, the signature ID id and the selected details), wafTime	Not shown; only on a conditional page specific to the internal network

• %WAF_INFO writes the same value as %WAFINFO; the JSON Default Blocking Page template uses this spelling.
• The attack details in %WAFINFO are selected from the SIEM & Attack Details card in the Learning & Reporting section of Left Monitor Panel → WAF-Protected vServices → vService → WAF Management: Attack Details in WAF Info by default includes the score (score), the attack area (scope) and the rule monitoring status (monitor); for Attack Payload in WAF Info, Same as 'detailed log' is selected by default and the caught value is added according to the Detailed Log setting of the area (WAF info content; details: Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?).
• General HTTP variables such as the path, the query, the request header, the country and the browser are added to these (What is a Smart Variable; how is it used in conditions and actions?). Reflecting the header, cookie or body sent by the client (%REQHEADER(...), %REQCOOK(...), %REQBODY(...)) on the page is avoided; the client input is written into the response as is.
• A standalone % character in the page content is not taken for a variable; no additional escaping is needed.

Recommended Usage

Audience	Content
External users	A general message + %UID (and %TIME)
API clients	{"error":"blocked","requestId":"%UID"} (Can I return a JSON blocking response instead of HTML for API clients?)
Internal network / test team	A separate conditional page with a Source IP condition; %WAFINFO and %WAFSCORE only here (Can I define different blocking pages depending on conditions (Conditional Blocking Pages)?)

Common Misconceptions

• "Showing the attack details helps the user." For a legitimate user, the details carry no meaning; the support team finds the record with %UID and sees the details in Event Logs.
• "Variables work only on an HTML page." They also work in all the content types of Manual Content (JSON, plain text …) and in the Content Pages profiles used in conditional pages.
• "%WAFINFO always contains the caught value." The caught value depends on the Attack Payload in WAF Info setting; if Never send is selected, it is not added.

How it is done in the documentation

• Blocking Page · Blocking Page
• Smart Variables · WAF
• WEB-CLI waf options · The WAF Info Content

Related questions

• What is a Smart Variable; how is it used in conditions and actions?
• Can I return a JSON blocking response instead of HTML for API clients?
• Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?