I turned off upload scanning but files are still blocked; why?

Short answer

OWASP Check in Upload on the Form tab manages only the file-by-file scanning of the content of uploaded files. In a multipart upload request, the whole body, including the file bytes, is scanned separately with OWASP Check on the Raw tab; this is the most common cause, and Raw without a parameter appears as the Attack area in the record (In multipart requests, is the whole body scanned separately as well?). The file name and the other fields go through the Form signature scan (Form@field); Allowed Upload Mime Types, Raw Body Size, Block Unparsed Contents and Block Invalid Form Contents are also independent of the upload scan. The setting may also have been turned off not in the rule the request matches but in another rule: if the page type has no Form common rule of its own, the value is inherited from Any Paths or from the glob rule that matches the path. The state of the setting is not shown in the detail panel; it is seen only in the Edit Common Rule for Form form. To exclude the file contents from scanning entirely, OWASP check is turned off in the Raw common rule of the upload page; if the false positive is a single signature, it is added to the OWASP Exclusions list of the same rule. For a 418 that has no record in Event Logs, on the other hand, a scan timeout (the 2-second time limit) is investigated.

Problem: Upload Scanning Is Off but Files Are Blocked

OWASP Check in Upload was turned off in the Form common rule of the upload page, but file uploads continue to receive the blocking response (default status code 418). Since a multipart upload request goes through more than one inspection, this setting is not the only source of the block.

Possible Causes

Shown on the Attacks tab	Cause	Solution
Signature name; Attack Area = Raw (without a parameter)	The Raw signature scan of the whole body; it is independent of OWASP Check in Upload	Method 1 or Method 2
Signature name; Attack Area = Raw@file-field	The file content is still scanned: the setting is not off in the rule the request matches	How to diagnose, steps 2–5
Signature name; Attack Area = Form@field	A signature in the file name or in the value of another field; the value of the file field is the file name	Can I turn off OWASP scanning for a specific parameter?
Allowed Upload Mime Types; Attack area = Form@type	The type detected from the content of the file is not in the allow list	File uploads are being blocked by the WAF; how do I fix it?
Raw Body Size, Block Unparsed Contents	The body size is outside the range of the rule, or the body did not fit into the inspection buffer	Large POST requests are blocked or cut off; why?
Block Invalid Form Contents, Block All Form Contents	The multipart body could not be parsed, or the rule does not accept a form body	File uploads are being blocked by the WAF; how do I fix it?
No record in Event Logs, response 418	The scan could not be completed within the 2-second time limit; with a large file, since the whole body is scanned, the probability increases. A timeout blocks only in Blocking mode, while Fail-open is off (default)	Why does a request that received 418 not appear in Event Logs?

Definitive rules:

• Scanning the file contents requires two settings to be on together: OWASP Check in Upload in the Form common rule and OWASP Check in the Raw common rule. If either of them is off, the file contents are not scanned file by file.
• Scanning the whole body depends only on OWASP Check in the Raw common rule. If Raw OWASP check is turned off, both this scan and the scanning of the file contents stop.
• Both scans use the OWASP Exclusions list of the Raw common rule; a signature added to the list produces no match in either scan. If the list is longer than the Max. OWASP Exclusions value (default 25), the Raw signature scan turns off entirely.
• A request is inspected with the Form and Raw common rules of the page type it matches. If the page type has no common rule of its own, the value is inherited from the glob rule that matches the path or from Any paths; in the detail panel, the Rule Source row shows the inherited rule (inheritance).
• OWASP Check in Upload is checked by default and is not shown in the table in the detail panel; its value is seen only in the common rule form.
• When the change is saved, the WAF configuration is regenerated and applied without a separate deployment step; there is no rollout time to wait for.

How to Diagnose?

1. The record of the blocked upload is found in Event Logs with Request Unique ID; on the Attacks tab, the Attack area value of every attack is matched against the table above. If there is no record, the Why does a request that received 418 not appear in Event Logs? page is followed.
2. Corresponding Rule shows the rule the request matched; Matching Path Rules on the Request & Location tab lists all the rules that match the path.
3. With the N page types link on the mode card of the host group in WAF Management, Page Types is opened and the rule in Corresponding rule is selected.
4. If there is a Rule Source row on the Form tab of the detail panel, the setting is inherited and the source rule is written in this row; if the rule in which OWASP Check in Upload was turned off is not this one, the change has not been applied to the request.
5. The value of the setting is read by opening Edit Common Rule for Form (if the rule has its own common rule) or the same form of the source rule; after the value is seen in the form, the form is closed without saving.
6. On the Raw tab, the OWASP Check row and the number of exclusions are read.

Solution: Three Methods

The methods are alternatives to each other. The change is made in the upload path's own page type; if Any paths is changed, its effect spreads to all requests that match no page type.

Your situation	Suitable method
Attack area Raw; the signature is a false positive, or the file contents are not to be scanned at all at this endpoint	Method 1: The Raw common rule of the upload page
Attack area Raw; a single signature is to be taught from the record	Method 2: Allow from Event Logs
The Raw OWASP scan at this endpoint is to be turned off from the command line	Method 3: WEB-CLI
The upload path has no page type of its own	First, a page type is added: File uploads are being blocked by the WAF; how do I fix it? (Method 2, steps 2–4)

Method 1: The Raw Common Rule of the Upload Page Recommended

• How it works In the Raw common rule of the upload page, the false positive signature is added to the OWASP Exclusions list, or OWASP Check is turned off. An exclusion removes only the selected signature; turning off OWASP check stops the signature scanning of the whole body and of the file contents on this page.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → Raw tab
• Requirement modify permission in the WAF area; the upload path's own page type
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Page Types screen

In the Left Monitor Panel, WAF-Protected vServices is selected, the vService is clicked and the WAF Management tab is opened. The N page types link on the mode card of the host group the request falls into is clicked (accessing the screen).

2

Adım 2 Select the rule

The row of the upload path is clicked; the detail panel opens.

3

Adım 3 Switch to the Raw tab

Raw is clicked in the tab strip of the panel.

4

Adım 4 Open the common rule form

If the rule has its own Raw common rule, Edit Common Rule for Raw is clicked; otherwise, Add Common Rule for Raw is clicked; the add form opens filled with the Raw values of Any paths (Add Common Rule for Raw screen).

5

Adım 5 Set the scanning

Wanted	Done in the form
Removing a single signature	OWASP Check stays checked; the Attack Name in the record is selected in the OWASP Exclusions list
Excluding the file contents and the whole body from scanning at this endpoint	The OWASP Check check is removed; the OWASP Exclusions field is hidden

Removing OWASP check weakens the signature inspection at this endpoint; Allowed Upload Mime Types, Raw Body Size and the Form scan of the file name continue to work.

6

Adım 6 Save

Edit in the form (or Add for a new common rule) is clicked; the change is applied without a separate deployment step. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1Detail panelTR7 side

The OWASP check row on the Raw tab of the rule is examined.

ExpectedThe number of exclusions increases, or the row appears off (-)

2UploadClient side

The same file is uploaded again.

ExpectedThe upload completes; no Attack area Raw record is formed

Method 2: Allow from Event Logs

• How it works The signature in the record is taught; the Learning Suggestion row writes that the signature will be taken into an OWASP exclusion (… will be marked as OWASP exclusion). The rule the teaching operation will change is seen in the Corresponding Rule row.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Event Logs → record → Attacks
• Requirement Modify permission in the WAF area; the record being present in Event Logs (host group in Monitor or Blocking mode)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Event Logs screen

In the Left Monitor Panel, the WAF-Protected vServices category is selected, the vService is clicked and the Event Logs tab is opened.

2

Adım 2 Enter the scope of the record

On the server filter tab, the Request ID on the blocking page is written in the Request Unique ID field, or Date Range is selected so as to cover the time the upload was made (server filter).

3

Adım 3 Fetch the record

Save & Get Logs is clicked.

4

Adım 4 Open the record

The row is clicked and the Attacks tab is selected in the preview; Attack Area, Corresponding Rule and Learning Suggestion are read.

5

Adım 5 Select the attack

In the attack table, only the box of the false positive signature is checked.

6

Adım 6 Click Allow

The button above the table is clicked. The button carries the name Allow in a blocked record and Teach in a record written in Monitor mode (Allow / Teach).

7

Adım 7 Confirm

Yes is clicked in the Are you sure? question; the change is applied without a separate deployment step. In a cluster setup, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize. Details: Which rule changes in the background when I Allow / Teach (Learning Suggestion)?

Verification

1Attacks columnTR7 side

The Attacks column of the taught record in Event Logs is examined.

ExpectedFirst number 0; row green

The first number of the column shows how many attacks the same request would trigger with the current rule set (Attacks column).

Method 3: WEB-CLI

• How it works In the Raw common part of the rule, OWASP Check is turned off with the WEB-CLI waf rule-parts update command; at this endpoint, the whole body and the file contents are excluded from signature scanning.
• Where it is opened WEB-CLI → waf host-groups · waf fw-rules · waf rule-parts
• Requirement WEB-CLI access and modify permission in the WAF area; the rule having its own Raw common part
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Get the host group ID

waf host-groups list poolId <vService>

The ID of the default host group is defaultHost.

2

Adım 2 Get the rule ID

waf fw-rules list poolId <vService> hostGroupId <group>

3

Adım 3 Get the ID of the Raw part

waf rule-parts list poolId <vService> hostGroupId <group> ruleId <rule>

The part whose region is raw is the Raw common part. If it is not in the list, the rule inherits the Raw settings; the common part is created in the interface with Add Common Rule for Raw in Method 1.

4

Adım 4 Turn off OWASP check

waf rule-parts update poolId <vService> hostGroupId <group> ruleId <rule> id <part> --argOwasp false

To remove a single signature, the exclusion is added from the interface, with Method 1 or Method 2.

Verification

1PartTR7 side

The part is displayed again.

Command: waf rule-parts show poolId <vService> hostGroupId <group> ruleId <rule> <part>

ExpectedargOwasp false

Common Mistakes

• Thinking that OWASP check in upload turns off all the scanning. The whole body is scanned separately with the OWASP check setting of the Raw common rule.
• Changing the setting in a rule the request does not match. The change is made in the rule written in Corresponding Rule in the record or in the rule that rule inherits from.
• Looking for the setting in the detail panel. OWASP Check in Upload is not shown in the panel; it is seen by opening the common rule form.
• Turning off Raw OWASP check in Any paths. All the request bodies that match no page type are excluded from signature scanning; the change is made only in the page type of the upload path.
• Switching the host group to Monitor mode to stop the 418s without a record. This removes all the WAF blocking in that group. For timeout blocks, the scanned body is reduced first; if the request cannot be reduced, Fail-open, which removes only these blocks, is turned on (Why does a request that received 418 not appear in Event Logs?).

How it is done in the documentation

• Form · OWASP Check in Upload
• RAW · OWASP Check
• RAW · Runtime: The RAW Inspection Order
• Path Check Fields · The Inheritance and Rule Source

Related questions

• Is the content of uploaded files scanned as well (OWASP Check in Upload)?
• In multipart requests, is the whole body scanned separately as well?
• How do inheritance and "Rule Source" work in rules?
• File uploads are being blocked by the WAF; how do I fix it?