Forum Discussion

Mulham_171271's avatar
Mulham_171271
Icon for Nimbostratus rankNimbostratus
Nov 20, 2017

ASM suggestions: Allowing Meta character on URL or globally

Hi Everyone,

 

I'm getting two different suggestions for the illegal metacharacter in URL (same char in both), one of them is suggesting to allow the metacharacter on URL level, the other is suggesting to allow the same metacharacter but in the URL character set, the only difference is that the second suggestion has the manual accept only sign.

 

Keep in mind I only have one wildcard URL(*), so the suggestions must be related to the same URL.

 

is this behavior expected? aren't both suggestions the same given my situation? what is the best practice in general? what does the manual accept indicate?

 

extra info: version 12.1.2 policy type automatic

 

application delivery
ASM Advanced WAF
asm policy
finetuning
security
url metachar
  • eey0re's avatar
    eey0re
    Icon for Cirrostratus rankCirrostratus
    Nov 21, 2017

    If you have just one URL, the 

    *
    wildcard, then yes - overriding that meta character on the URL is functionally the same as overriding it in the character set.

    I'm not sure there is a best practice in this situation. It comes down to whether you think you may add more specific URLs in future and if so, whether you will want this meta character to be allowed on those too.