Can I allow only certain HTTP methods on a page (Allowed Methods)?

Short answer

Yes. In the Allowed Methods field of the rule, Multiple Methods is selected and the allowed methods are checked; a request that comes with a method that is not in the list gets 24 points as an Allowed methods violation in the Structure Policies category. Since this score reaches the blocking threshold at every OWASP Protection Level, the request is blocked by this violation alone in Blocking mode and is recorded without being blocked in Monitor mode; in Learning mode, no method check is done. Any Methods (the default in a new rule) does no method check, and None counts every method as a violation. The setting is not inherited: every exact and glob rule applies its own list, and the list of Any Paths (GET, OPTIONS, HEAD, POST, PUT, PATCH, DELETE) is applied only to the paths that do not have their own rule. The method check is independent of the Structure Checks switch. The same setting is also made in WEB-CLI with waf fw-rules update.

Problem: A Path Is Called with Unexpected HTTP Methods

Requests that come with methods such as PUT, DELETE or TRACE to a page where only GET and POST are expected reach the application. If the path's own rule has no method restriction (Any Methods), the method list of Any paths is not applied to that path either; the restriction is defined in the path's own rule.

Solution: Two Methods

Your situation	Suitable method
From the interface	Method 1: Rule form
A script or the command line; the method list of the rule is empty (Any methods)	Method 2: WEB-CLI
There is no rule for the path yet	The rule is added first → How do I add a new page type manually?

Method 1: Rule Form Recommended

• How it works The Allowed methods list is set in the Edit form of the rule; a request that comes with a method that is not in the list produces a violation.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → mode card of the host group → N page types → rule → Edit
• Requirement WAF protection enabled on the vService; a rule for the path (if there is none, it is added first)
• vService type HTTP vService with WAF protection enabled

Step-by-Step Configuration

1

Adım 1 Open the Page Types tab

In the Left Monitor Panel, the vService is clicked on the WAF-Protected vServices tab, the WAF Management tab is opened and the N page types row under the mode card of the relevant host group is clicked (accessing the screen).

2

Adım 2 Select the rule

The rule of the path is checked in the list.

3

Adım 3 Open the Edit form

Edit on the toolbar is clicked (accessing the edit screen). The same form is also opened with Edit in the right-click menu of the row, with Edit in the header of the detail panel or with Edit Common Rule for Path on the Path tab.

4

Adım 4 Select the methods

Multiple Methods is selected from the Allowed Methods list; the allowed methods are checked in the list next to it (at least one method is required; a method outside the list cannot be written). The other options: Any Methods does no method check, and None counts every method as a violation.

5

Adım 5 Save

Edit at the bottom of the form is clicked; the change is applied without a separate deployment step. In a cluster setup, with the default auto-sync, the change is also sent to the peer device automatically; if Manual Sync Mode is on, it is sent manually with Synchronize.

Verification

1Detail panelTR7 side

The row is clicked and the Allowed methods value on the Path tab of the detail panel is examined (displayed fields).

ExpectedGET, POST

2Method not allowedClient side

While the host group is in Blocking mode, a request with a disallowed method is sent to the path; then the Attacks tab of the Event Logs record is examined.

Command: curl -i -X PUT https://www.example.com/sayfa

ExpectedBlocking response (default 418) · Attack name: Allowed methods

In Monitor mode, the request passes, and the record is still created. The status code of the blocking response comes from the Blocking Status Code setting.

Method 2: WEB-CLI

• How it works The method list of the rule is written with waf fw-rules update.
• Where it is opened WEB-CLI → waf fw-rules list · waf fw-rules show · waf fw-rules update
• Requirement WEB-CLI access; the IDs of the rule and of the host group
• vService type HTTP vService with WAF protection enabled

Step-by-Step Configuration

1

Adım 1 Get the rule ID

The rules of the host group are listed; the rule ID is the id value (the ID of the default host group is defaultHost):

waf fw-rules list poolId <vService> hostGroupId <group>

2

Adım 2 See the existing method list

waf fw-rules show poolId <vService> hostGroupId <group> <rule>

If the allowedMethods value is Any Methods (any) or None (none), no method list is in use and the new list is written from index 0. If the rule already has a method list, --allowedMethods.input.N replaces the method at that position and does not delete the extra methods that remain. If the rule was saved earlier with Multiple Methods and then switched to Any Methods or None, the old list may remain in the record; if a list that is filled or was used before is to be narrowed, Method 1 is used.

3

Adım 3 Write the method list

The example allows only GET and POST on a rule with an empty list (allowed HTTP methods):

waf fw-rules update poolId <vService> hostGroupId <group> id <rule> --allowedMethods.type multiple --allowedMethods.input.0 GET --allowedMethods.input.1 POST

WEB-CLI accepts only the GET, HEAD, OPTIONS, POST, PUT, PATCH, DELETE, TRACE and CONNECT methods; the list in the interface also includes the WebDAV methods in addition to these.

Verification

1Rule recordTR7 side

The rule is displayed again.

Command: waf fw-rules show poolId <vService> hostGroupId <group> <rule>

ExpectedallowedMethods: multiple · GET, POST

Common Mistakes

• Assuming None means "no restriction". None counts every method as a violation and blocks every request that comes to the path; if no restriction is wanted, Any Methods is selected.
• Relying on the list of Any paths. Exact and glob rules do not inherit the method list; a rule left with Any methods has no method restriction (If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?).
• Forgetting OPTIONS. The CORS preflight of browsers comes with OPTIONS; if it is not in the list, these requests produce violations.
• Doing the tightening directly in Blocking. The effect is first observed in Monitor mode; since the method check does not run in Learning mode, the result is not seen there.
• Assuming that turning off Structure checks also turns off the method check. Structure checks turns off the length, count, size, depth and value pattern checks and the invalid-body blocks; the Allowed methods check continues (What do the Structure Checks and Argument Checks master switches do; what happens if I turn them off?).

How it is done in the documentation

• Add · Allowed Methods
• Path · The Displayed Fields
• Edit · Accessing the Edit Screen
• WEB-CLI waf fw-rules · The Allowed HTTP Methods

Related questions

• How do I set up a positive security model for an API (allowed endpoints, methods, parameters)?
• What do the Structure Checks and Argument Checks master switches do; what happens if I turn them off?
• How are settings (methods, OWASP) combined during a Merge?