Why are rules learned from headers written to the Any Paths rule rather than per page?

Short answer

Because headers define the site, not a single page: browsers and client libraries send the same set of headers to every address; therefore the allowed header names and the header inspections are kept in a single site-wide list (Learning Methods). AI Learning, Teacher, Learn Selected and Allow / Teach always write header learning to the shared Any Paths rule, whatever the Rule Creation Policy is (including Comprehensive); even if there is a page type that matches the path, header learning is not written there. In this way, a single list is maintained instead of header lists that multiply per path, and Default appears in the Path column on the monitoring screens. As a result, a header learning written to Any paths affects all paths; the Revert Learning confirmation window states this separately. If desired, header inspection can be enabled manually per path: on the Header tab of the page type of that path, a page-specific common header inspection is defined with Add Common Rule for Header, and a rule specific to a certain header with Add Argument Rule for Header (Path-specific header inspection); this inspection replaces the Header inspection of Any paths on its own path, and AI learning, Teacher, Learn selected or Allow / Teach do not write to it. Analysis & Learning also collects the allowed header list in the Any paths rule; only in an analysis run with Combine with Old Rules, the headers of the requests that match a page type with its own Header inspection field defined are processed into the Header field of that page type.

Consequences

	Description
Where it is written	The Header inspection field of the Any Paths rule
Policy effect	None; the same in Page independent, Data based and Comprehensive
Area of effect	All paths in the host group
On the monitoring screens	Path column Default (AI Learning Tracking screen)
Reverting	The confirmation window shows the note "This learning was written to the "Any paths" rule, which is shared: reverting it affects every path." (reverting the learning)
Page-specific header rule	Manually, on the Header tab of the page type (Path-specific header inspection; Can I require a specific header to be present?)

• Default header rules: What are the default header rules? · Inheritance: How do inheritance and "Rule Source" work in rules?
• The effect of the policy in other areas: Does changing the Rule Creation Policy change existing rules?

Path-Specific Header Inspection (Manual)

Although header learning is written to Any paths, header inspection can be enabled manually for a single path. The page type's own Header inspection replaces the Header inspection of Any paths on that path. AI learning, Teacher, Learn selected and Allow / Teach do not write to this inspection, and it is maintained manually; only an Analysis & Learning result applied with Combine with Old Rules can widen it (Header · What Is Header?).

1

Adım 1 Open the Page Types list

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the page type count row on the mode card of the host group is clicked; the Page Types list of the group opens.

2

Adım 2 Create a page type for the path (if needed)

If there is no page type that matches the path, a page type with an Exact or Glob path is created with Add on the toolbar and saved (How do I add a new page type manually?).

3

Adım 3 Open the Header tab

The page type is clicked in the list; in the detail panel that opens on the right, the Header tab is selected. The Rule source row at the end of the table shows from which rule (e.g. Any paths) the inspection is currently inherited.

4

Adım 4 Add the common header inspection

Add Common Rule for Header above the table is clicked; the form opens filled with the Header values of Any paths (Add Common Rule for Header screen). The Header Key Length, Header Key Count, Total Header Size, Allowed Headers, Required Headers, Header Value Length, Header Value Pattern, Header Value Count, OWASP Check and Detailed Log fields are set according to that path.

5

Adım 5 Save

Add in the form is clicked; inheritance ends for this page type and the Rule Source row disappears. When the page type has its own Header inspection, the button appears as Edit Common Rule for Header and Delete Common Rule for Header.

6

Adım 6 Add a rule for a specific header (if needed)

If only a specific header is to be restricted, the name of that header is written in the Argument Name field with Add Argument Rule for Header in the variable table; Header Value Length, Header Value Pattern, Header Value Count, OWASP Check and Detailed Log are set and the rule is saved with Add (Argument rules). Allowed Headers and Required Headers exist only in the common rule.

• Prerequisite switches: Header Key Length, Header Key Count, Total Header Size, Header Value Length, Header Value Count and Header Value Pattern are applied while the vService-wide Structure Checks is on; Allowed headers and Required headers are applied while Argument Checks is on. If the switch is off, the related fields are not applied and do not appear in the panel. When WAF is turned on, both switches are on; OWASP check is independent of these switches (What do the Structure Checks and Argument Checks master switches do; what happens if I turn them off?).
• Allowed headers limit: If the manually entered Allowed Headers list exceeds the Max. Allowed Arguments value (25 when WAF is turned on), the list is not applied for that page type; it remains in the record (What is Max. Allowed Arguments for; what happens if a page's learned argument list exceeds this number?).
• Removal: Delete Common Rule for Header removes the common inspection without asking for confirmation; the path inherits from Any paths again. The common Header inspection of the Any paths rule cannot be deleted.
• Change: The save is applied without a separate deployment step; in a cluster, it goes to the peer device with the default auto-sync. The operation requires modify permission in the WAF area.

Common Misconceptions

• "When Comprehensive is selected, headers are also learned per page." Header learning is written to Any Paths in every policy.
• "Reverting a header learning affects only one page." Because it is a shared rule, it affects all paths.
• "The manually written header rule in the page type is updated by learning." AI Learning, Teacher, Learn Selected and Allow / Teach write only to Any paths; the rule in the page type remains under manual maintenance. The exception is an Analysis & Learning result applied with Combine with Old Rules: if the page type has its own Header field, the analysis can widen this field.

How it is done in the documentation

• Learning Methods · What Is Learning Methods?
• AI Learning & Teacher Tracking · Reverting the Learning
• Path Check Fields · Header
• WAF · Terminology

Related questions

• What are the default header rules?
• How do inheritance and "Rule Source" work in rules?
• Does changing the Rule Creation Policy change existing rules?