In which parts of a request are signatures scanned (Path, Query, Header, JSON, XML, Form and Raw)?

Short answer

Signatures are scanned in seven sections of the request. Every rule determines in which sections it will be searched for with the Inspection Scopes field in the rule form; the options carry the names Path, Query, Header, JSON, XML, Form and Raw in the form, and the names URI Path, Query String, HTTP Headers, JSON Body, XML Body, Form Data and Raw Body in the list and in the Active Signature Fields row in the preview (the distinction between the signature and the pattern). In Path, the request path is scanned; in Query, the names and values of the query parameters; in Header, the header names and values (cookies inside the Cookie header); in JSON and XML, the keys and text values of the parsed body; in Form, the names and values of the form fields; in Raw, on the other hand, the body that cannot be parsed, the whole multipart body and, if OWASP Check in Upload is on, the content of the uploaded files are scanned. Whether a section is really scanned also depends on the OWASP Check setting of that section or parameter being on in the page type that the request matches; the signatures in the OWASP Exclusions list are not searched for in that parameter. While the host group is in Learning mode, these two settings are ignored and all sections are scanned.

How Does It Work?

Name in the form (Inspection Scopes)	Name in the list (Active Signature Fields)	What is scanned	Signature count
Path	URI Path	The request path, normalized and with its percent-encoding decoded	828
Query	Query String	The name and the value of every parameter separately; the values in their raw form and in their once URL-decoded form	2,824
Header	HTTP Headers	The name and the value of every header separately, in their raw form; including the Cookie header (Are cookies scanned?)	711
JSON	JSON Body	The keys and text values in the parsed JSON body	1,830
XML	XML Body	The element names and text values in the parsed XML body	412
Form	Form Data	The names and values of the application/x-www-form-urlencoded fields (the values in their raw form and in their once URL-decoded form); in multipart requests, the form fields	2,775
Raw	Raw Body	The body that cannot be parsed or is not recognized; the whole multipart body; if OWASP Check in Upload and the OWASP Check on the Raw tab are on, the content of every uploaded file (Is the content of uploaded files scanned as well (OWASP Check in Upload)?)	937

The signature count column is the number of built-in signature rules in that scope.

• A section is scanned if OWASP Check is on in the related tab of the page type that the request matches (What does turning OWASP scanning on or off at the Page Type level mean?); if OWASP Check is off in an argument rule specific to the parameter, or if the signature is in the OWASP Exclusions list of that parameter, the signature is not searched for in that parameter (Can I turn off OWASP scanning for a specific parameter?).
• The same seven sections are also the unit of the positive inspections: What is Check Fields; into which seven parts does the WAF split a request to inspect it?
• A signature is never searched for in a section that is not selected in the rule form. Narrowing the scope is the way to remove a false positive from that section without turning the signature off (What is the "Inspection Scopes" field for when adding a custom rule?).

Common Misconceptions

• "Cookie is a separate scope." Cookies are scanned in the Header (HTTP Headers) scope, as the value of the Cookie header.
• "If the scope is selected, the section is scanned under all conditions." If the OWASP Check setting of that section or parameter is off in the page type, it is not scanned, except in Learning mode.
• "A multipart body is scanned only as form fields." Besides the form fields, the whole body is also scanned in the Raw scope.

How it is done in the documentation

• Signature & Rule Library · The Distinction Between the Signature and the Pattern
• Signature & Rule Library · Inspection Scopes
• Path Check Fields · The Tabs and the Section They Inspect
• Query · OWASP Exclusions

Related questions

• What is Check Fields; into which seven parts does the WAF split a request to inspect it?
• Is the content of uploaded files scanned as well (OWASP Check in Upload)?
• What does turning OWASP scanning on or off at the Page Type level mean?