Forum Discussion

natethegreat_23's avatar
natethegreat_23
Icon for Nimbostratus rankNimbostratus
Aug 24, 2018

Blocking a request if the URL meets two parameter requirements?

I have a API request that has two parameters that can easily be tampered. The problem is that there are legitimate requests that will match the numbers if I only have a parameter rule on one of the values and not the other. So I need a way to have the equivalent of a "AND" statement saying if VariableA=x and VariableB=y to block the request. But if VA=x and VB= to not block anything. Is this a possibility in the standard settings for ASM parameters or will this require some type of iRule. Thank you!

 

ASM Advanced WAF
parameter
security
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Aug 24, 2018

    you can't create condition on 2 parameters in ASM. you have to create an irule.

    in irule, you can get parameter value with command:

    set VariableA [URI::query [HTTP::uri] VariableA]
set VariableB [URI::query [HTTP::uri] VariableB]

    Regards,

    Stanislas