ASM : Context AMF Body

Hi, hopefully this is still relevant.

The AMF body context is used to place the entire POST body into a single parameter value for purpose of applying signatures. As you probably saw though, this results in many false positives and removes ability to control overrides and content handling at the parameter level.

The reason AMF body is happening is usually because the multipart request is not proper RFC. If you enable the "bad multipart request" violation in the policy at alarm level you will likely see this violation is occurring as well. If this violation occurs we cannot parse the parameters in the multipart request therefor we fall back to using AMF body.