Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is Max. Allowed Arguments for; what happens if a page's learned argument list exceeds this number?
Short answer
Max. Allowed Arguments is the maximum number of names that can be kept in the allowed name lists of a page type (Allowed query parameters, Allowed headers, Allowed form fields, Allowed JSON keys, Allowed XML keys); it is visible in the Checks window while Argument Checks is on, and it is 25 when WAF is turned on. If the allowed name list of a page exceeds this number, that list is not applied and the page allows all names in that section. During learning, the allowed and required lists that exceed the limit are emptied, and an emptied list is not filled again in later learning runs; a long allowed list entered manually, on the other hand, is not deleted, it is only not applied. The Checks card shows this with the sentence If a page's learned argument list grows past N entries, the list check is dropped for that page. The aim is to prevent the positive list from producing false positives on pages that use a large number of different names. The value is changed from the Checks window and saved with Edit.
When the Limit Is Exceeded
| Place | Result |
|---|---|
| Learning and adding the suggestions to the rule | The allowed (Allowed) and required (Required) lists that exceed the limit are emptied; an empty list stays empty in later learning runs |
| Applying the rule | An allowed name list that exceeds the limit is not applied (including one entered manually); the list in the record is not deleted, and it is applied again when the limit is raised |
| Event Logs | No Allowed … violation occurs in that section of that page |
| Other inspections | Value length, value pattern, key count and the OWASP signature scanning continue |
- During learning, the Allowed Upload Mime Types and Allowed Raw Body Mime Types lists are also merged with the same limit.
- The limit is not the number of parameters that can come in a request; the number of parameters is limited with structural inspections such as Query key count.
- Max. OWASP Exclusions works in a similar way for the signature exclusion list (What does the "Max. Owasp Exclusions" setting do; what happens if the limit is exceeded?).
- Using the allowed parameter list: How do I make sure only the query parameters I allow reach a page (Allowed Query Parameters)?
Changing the Limit in TR7
1
Adım 1 Open the Checks window
In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Checks card in the Inspection & Blocking section is clicked.
2
Adım 2 Write the value
An integer of 1 or greater is written in the Max. Allowed Arguments field (e.g. 50 for a broad API). The field is visible only while Argument Checks is on.
3
Adım 3 Save
Edit is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.
- WEB-CLI:
waf options update poolId <vService> --syncWithDefaultFwRules false --maxAllowedArguments 50(basic inspections). - Lists emptied earlier: After the limit is raised, the learning does not fill an emptied list again; the necessary names are entered manually in the rule of the page type.
Common Misconceptions
- "When the limit is exceeded, the request is blocked." On the contrary, the name list inspection is removed in that section of that page.
- "The limit is the number of parameters that can come in a request." The limit determines the size of the recorded name list; the number of parameters in the request is limited with structural inspections.
- "Raising the limit brings back the lost list." A list entered manually and only not applied comes back; a list emptied in learning does not come back.
How it is done in the documentation
