Forum Discussion

Hussein_Ghazy's avatar
Hussein_Ghazy
Icon for Nimbostratus rankNimbostratus
May 20, 2016

Filter Specific ajax requests under a URL and grant access accordingly

Hi All,

 

I have special requirement for the ASM to check on "xyz" parameter and only grand access to the web server if the value of the parameter is mapmap or xy_get_data.

 

I created the parameter under parameters and linked it to the specific URL, enable blocking on the blocking page. However, i am not able to know where i can specify the values mapmap or xy_get_data.

 

Thanks in advance.

 

Regards

 

Hussein

 

ASM Advanced WAF
security

2 Replies

  • Arnaud_Lemaire's avatar
    Arnaud_Lemaire
    Icon for Employee rankEmployee
    May 24, 2016

    Hello Hussein,

     

    i'm not sure ASM is really able to do that. what you could implement :

     

    • a LTM policy to allow or reject based on the presence of this parameter
    • an irule doing the same with the possibility to trigger an asm violation in this case
    • a signature in ASM (but i'm not sure if with can implement negative matching)
  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    May 25, 2016

    If your parameter is only allowed to have two permitted values create it as a static parameter type in your policy and add your allowed values as static values. Make sure "Allow Empty Value" is un-ticked. Make sure your policy is blocking on violation: "Illegal static parameter value" .

     

    That's it!