Forum Discussion
ASM irule to disable attack signature authorization header with specific value
- Apr 10, 2023
Hi f5learner,
Can you try this iRule?
when ASM_REQUEST_DONE { if { [ASM::violation names] contains "VIOLATION_ATTACK_SIGNATURE_DETECTED" && [HTTP::header Authorization] starts_with "Bearer" } { ASM::unblock } }
Trigger ASM iRule Events Mode should be set Normal on the WAF policy.
Note that if the request has any violations other than "attack signature detected", the request will be completely unblocked.
- Apr 20, 2023
Hi,
When more than one violation occurs, if "Block" is active in one violation, but not in the other violation, the request_status for ASM::violation_data does not occur individually. It is defined as "block".
A separate control is required for violations that are not in the block. I think, rather than using such an iRule, a simple policy should be preferred.
https://clouddocs.f5.com/api/irules/ASM__violation_data.html
Hi f5learner,
Can you try this iRule?
when ASM_REQUEST_DONE {
if { [ASM::violation names] contains "VIOLATION_ATTACK_SIGNATURE_DETECTED" && [HTTP::header Authorization] starts_with "Bearer" } {
ASM::unblock
}
}
Trigger ASM iRule Events Mode should be set Normal on the WAF policy.
Note that if the request has any violations other than "attack signature detected", the request will be completely unblocked.
thank you so much for response you mentioned
"Note that if the request has any violations other than "attack signature detected", the request will be completely unblocked."
how can I ensure that other violations are not completely unblocked and get assessed by other WAF rules. I only want to disable attack signatures on HTTP header authorization with value containing "Bearer" , the remaining payload and other requests should be evaluated as normal.
Also in above syntax how can I also enable logging everytime authorization header containing Bearer bypasses.
Thank you so much for your help
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com