With "Do not WAF static contents" on, under which condition is a request considered static?

Short answer

Four conditions must be met together: the path must end with one of the static file extensions in the list, the method must be GET, there must be no query string in the request and the body must be empty (Do not WAF static contents). The extension list covers image, font, style, document and video files; .js, .html, .ico and .map are not in the list. A request considered static does not enter WAF at all: the signature scanning, the structural inspections, the blacklist check and the learning are not done, no record is written to Event Logs and the request is counted in the Whitelisted category on the Dashboard. If one of the conditions is not met, for example in a /logo.png?x=1 request or a .pdf request that comes with POST, the request enters the normal inspection. The setting applies across the vService, is on when WAF is turned on and is changed from the Whitelist & Blacklist window. That the exemption is applied on the vService is verified by a static file request that meets the conditions being counted in the Whitelisted category on the Dashboard.

Conditions

Condition	Treated as static	Inspected
Extension (end of the path)	.txt .bmp .jpeg .jpg .png .gif .tif .tiff .svg .svgz .webp .pdf .ps .ttf .woff .woff2 .css .csv .doc .docx .xls .xlsx .ppt .pptx .mid .midi .swf .mp4 .flv .mov .wmv .avi .ogg .mkv .mpg	.js .html .ico .map and all extensions not in the list
Method	GET	HEAD, POST, PUT and others
Query string	None	Present (a query that starts with ? after the path)
Body	Empty	Not empty

• When considered static: WAF, the blacklist and the learning are skipped; no record is written to Event Logs; it is counted as Whitelisted on the Dashboard (Is the traffic I whitelist logged at all; where does it appear on the dashboard?).
• Together with Whitelist condition: The two exemptions are independent of each other; if the request matches either of them, it does not enter WAF (Can I exempt certain IPs or requests from WAF inspection entirely (Whitelist Condition)?).
• Verification: After a request that meets the conditions (e.g. curl -s -o /dev/null "https://www.example.com/logo.png") is sent, the Whitelisted count on the Dashboard should increase and the request should not appear in Event Logs; if the Whitelisted count does not increase, the request is going through the WAF inspection.
• Card line: On the Whitelist & Blacklist card, Static content bypasses WAF inspection is shown while it is on, and Static content whitelist is off while it is off.
• Security assessment: Which requests are treated as "static content" and excluded from WAF inspection (extension, method, query and body conditions); is this safe?
• Performance: What does excluding static content from inspection gain in performance?

Changing the Setting in TR7

1

Adım 1 Open the Whitelist & blacklist window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Whitelist & blacklist card in the Inspection & Blocking section is clicked.

2

Adım 2 Change the switch

The Do not WAF static contents switch is turned on or off.

3

Adım 3 Save

Edit is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

• WEB-CLI: waf options update poolId <vService> --syncWithDefaultFwRules false --dontWafStaticContent false (WAF scope); to turn it back on, the value true is written.

Common Misconceptions

• "JavaScript files are also considered static." .js is not in the list; these requests are inspected.
• "The extension is enough." If there is a query string, a body or a method other than GET, the request is inspected; requests such as /x.png?cmd=... cannot benefit from the exemption.
• "Static requests still go through the blacklist check." Since a request considered static does not enter WAF at all, the WAF blacklist check is not done either.

How it is done in the documentation

• Whitelist & Blacklist · Do Not WAF Static Contents
• Whitelist & Blacklist · The Whitelist & Blacklist Card on WAF Management
• Dashboard · WAF Inspection Distribution

Related questions

• Which requests are treated as "static content" and excluded from WAF inspection (extension, method, query and body conditions); is this safe?
• What does excluding static content from inspection gain in performance?
• Is the traffic I whitelist logged at all; where does it appear on the dashboard?