Forum Discussion
Sergio_Magra
Nimbostratus
NimbostratusDisabling signatures for web services parameters
Hi everybody,
we are trying to protect Web Services. We implemented Content Profile protection.
When testing, we generate an attack inside a value of a Web service query, for example:
valor
valor ' or 1=1--
4444444
As is supposed, it generates an attack detection.
The problem is that the detection of this attack is done at URL (request) level, and not to a parameter or tag level. I am referring to a xml parameter or tag inside xml content,
If we need to make an exception for this attack, we have to disable the signature globally (for the entire profile).
So, it is possible to do expections at parameter or tag level using Content profiles?
Thanks and best regards
13 Replies
TortiCirrus
Hi,
I still did explain it in my message @ 10.1. above. You can use the policy builder, too. There you have to select the web service option.
When you create a xml content profile and you don't have the schema files, you only have to save the profile. Thats it.
You can read the documentation @ ask.f5.com, too.
If you don't have any skills in this area, I recommend a workshop by a consultant. They are really helpful.
regards
Sergio_MagraThanks for the answer and recommendations.
When you say:
When you create a xml content profile and you don't have the schema files, you only have to save the profile. Thats it.
This have relationship with polcy builder or it is another option?
If it is an option: I have to specify in some place what XML parameter I want to protect. Am I right?
Also, I searched ask.f5.com but nothing seems to be that we are looking for.
Thanks and Best regards- TortiIf you don't get the schema files, it is like a normal web application policy and not like an web service policy.
You can map a xml content profile with a parameter, too.
You have to create the parameter, first. Then set it as xml parameter and map the content profile.
But again, you need the schema files for full security. You cannot validate the xml content or structure without it!
regards
