Forum Discussion
AndréB
Nimbostratus
NimbostratusASM / WAF : block request containing certain string?
I have added as much XSS blocking to a policy as possible. A request containing onmouseover or onclick or .... ="alert('hello')" is blocked fine. But when it's coded like onmouseover or onclick or ...
AndréBNimbostratus
NimbostratusHi Sajid,
Your suggestion creates a "global" attack signature. And will, on creation, as I read it, be added to all the policies.
We have several policies running and I don't want to mess up policies for which I'm not responsible.
There is an attack signature self[] (parameter) (id 200101630) to choose from and is already added/active to the policy.
But it doesn't block self['\x... ], self with HEX in it as it is added in the value part of a parameter.
Maybe it's better to report it to F5 Support