What is "Wait for body for a time" for?

Short answer

Wait for body for a time limits how long WAF waits for the request body. While it is off (the state when WAF is turned on), the arrival of the whole body or the filling of the processable size is awaited; the upper limit of this wait is the HTTP Request Timeout value in the timeout profile bound to the vService. While it is on, the body is awaited for at most the Time to Wait Body time (default 300 ms; unit ms or s); when the time runs out, the uncompleted body is not parsed and the decision is left to the Block Unparsed Contents setting on the Raw tab of the page type: if Block unparsed body, the request gets a violation; if Allow unparsed body, the body passes without being inspected. The setting shortens the wait in WAF of requests whose body arrives slowly; its cost is that legitimate uploads that do not complete within the time are blocked or their body passes without being inspected. The setting is changed from the Request Body Limits window and saved with Edit.

Two States

	Off (the state when WAF is turned on)	On
Wait	Until the whole body arrives or the processable size fills; upper limit HTTP Request Timeout	At most Time to Wait Body
Body completed in time	Normal inspection	Normal inspection
Uncompleted body	-	Not parsed → if Block unparsed body, a 24-point violation; if Allow unparsed body, passing without inspection (What happens to request bodies that exceed the Max. Body Size to Process(kB) limit or do not complete in time?)
Card line	-	Body completion is awaited for up to 300 millisecond(s)

• Any paths rule: Allow unparsed body comes selected on the Raw tab; when the setting is turned on, bodies that do not complete in time pass without inspection unless otherwise selected in the page type (What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?).
• Recommendation: It is left off. If it is to be turned on, the time is selected according to the time the slowest legitimate client takes to send the body, and the selection on the Raw tab is reviewed in the page types that receive large uploads.
• Scope: The setting applies across the vService and is common to all host groups.

Changing the Setting in TR7

1

Adım 1 Open the Request Body Limits window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Request body limits card in the Inspection & Blocking section is clicked.

2

Adım 2 Turn on the wait limit

The Wait for body for a time box is checked; the Time to Wait Body field appears below it.

3

Adım 3 Write the duration

The time is written in the Time to Wait Body field and the unit (ms or s) is selected (e.g. 2 s).

4

Adım 4 Save

Edit is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

• WEB-CLI: waf options update poolId <vService> --syncWithDefaultFwRules false --dontBufferRequest true --waitForBodyMs.val 2 --waitForBodyMs.unit s (body processing); the --waitForBodyMs fields are accepted only with --dontBufferRequest true.

Common Misconceptions

• "When the time runs out, the request is dropped." The request enters the inspection with the information at hand; what happens to the body is determined by the selection on the Raw tab of the page type.
• "While it is off, the body is not awaited at all." On the contrary, while it is off, the whole body is awaited.
• "Fail-open in the same window lets a body whose time ran out through." Fail-open is not related to the body wait; it is applied only to a request whose scan cannot be completed within the time limit in the Blocking mode. Waiting for the body does not count toward this time; the fate of an uncompleted body is determined by Block Unparsed Contents on the Raw tab (What is the maximum value of Max. body size to process; how does it relate to the log limit?).

How it is done in the documentation

• Request Body Limits · Wait for Body for a Time
• Request Body Limits · Time to Wait Body
• WEB-CLI waf options · The Body Processing

Related questions

• What happens to request bodies that exceed the Max. Body Size to Process(kB) limit or do not complete in time?
• What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?
• Large POST requests are blocked or cut off; why?