Application firewalling quandary

Hi Ian,

 

 

The perfect scenario is if the app uses clientside Javascript to "ask" the user to not enter invalid characters, ASM is blocking with a tight configuration and the app does proper validation of the user input. Then you can keep ASM blocking these types of violations and still give the user a good experience. If you know the app handles validation for these fields successfully, you could relax the ASM charset either for specific parameter values or for all parameter values. If the app doesn't do proper sanitisation of user input, I'd say it's better to block errant user-input and protect the app.

 

 

I've heard preliminary discussions of the ability to strip meta-characters from specific parameter values. You might consider talking with your account manager to put in a request for this type of functionality.

 

 

Aaron