What does the URL Decoding setting affect; are query and form values decoded too?

Short answer

URL Decoding affects only the path part of the request and is on when WAF is turned on. While it is on, the path is decoded once before all inspections; the page type matching, the Path structural inspections and the signature scanning are done on the decoded path. While it is off, the path is matched with the page type and goes through the structural inspection in its encoded form; the signature scanning scans both the encoded and the once-decoded form of the path. Query and form values are independent of this setting: the encoded text is first split into parameters at the & and = characters, and the signature scanning scans the encoded and the once-decoded form of every key and value; thus the parameter boundary cannot be evaded with an encoded & (%26). The setting is changed from the Checks window and saved with Edit.

Effect

Section	URL decoding on	URL decoding off
Path · page type matching	Decoded path (/admin%2Flogin → matches the /admin/login page type)	Encoded path (/admin%2Flogin does not match the /admin/login page type)
Path · structural inspection (Path length, Path depth)	Decoded path	Encoded path
Path · signature scanning	Decoded path	Encoded and once-decoded form
Query and form · splitting into parameters	On the encoded text	Same
Query and form · signature scanning	The encoded and once-decoded form of every key and value; + counts as a space	Same

• Decoding depth: In every case, at most one step is decoded; a double-encoded value (%2527) is seen as %27 in the scanning.
• Header, JSON and XML: URL decoding is not applied; the values are scanned as they arrive.
• Card line: While it is on, the Checks card shows URLs are decoded before inspection; while it is off, it is listed in the URL decoding is off line.
• Scope: The setting applies across the vService and is common to all host groups.

Changing the Setting in TR7

1

Adım 1 Open the Checks window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Checks card in the Inspection & Blocking section is clicked.

2

Adım 2 Change URL decoding

The URL Decoding box is checked or unchecked.

3

Adım 3 Save

Edit is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

• WEB-CLI: waf options update poolId <vService> --syncWithDefaultFwRules false --decodePaths false (WAF scope); to turn it back on, the value true is written.
• Recommendation: The setting is left on. Turning it off is considered only where an encoded character in the path (e.g. %2F) carries a separate meaning for the application and the page types are defined in their encoded form.

Common Misconceptions

• "When it is turned off, the signature scanning misses encoded attacks." While the setting is off, the signature scanning also scans the once-decoded form of the path.
• "The setting also covers the query and the body." It affects only the path; the query and the form are processed the same way in every case.
• "While the setting is off, the encoded path falls into the same page type." The encoded path is compared literally; the /admin%2Flogin request does not get the rule of the /admin/login page type.

How it is done in the documentation

• Checks · URL Decoding
• Checks · The Checks Card on WAF Management
• WEB-CLI waf options · The WAF Scope

Related questions

• What do the Structure Checks and Argument Checks master switches do; what happens if I turn them off?
• What is a Page Type?
• How does TR7 WAF decide whether to block a request?