Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

Jack3's avatar
Jack3
Icon for Nimbostratus rankNimbostratus
9 months ago
Solved

How to allow Request getting blocked due to Malformed JSON data

Hi Everyone,

I've little trouble understanding how i can allow this request.

Requests are getting blocked at WAF end due to "Malformed JSON data" violation (Illegal character encountered - json syntax error -" / ")

 

Can i allow / (forward slash) character to provide exception for this violation & keep malformed json data blocking setting as it is. and how can i achieve this.

 

  • Enes_Afsin_Al's avatar
    Enes_Afsin_Al
    8 months ago

    Hi Jack3,

    • Create a new JSON profile.
      Security > Application Security > Content Profiles > JSON Profiles > Create New JSON Profile...
    • Edit the properties according to the JSON profile used by default.
    • Disable Parse Parameters option.
    • Allow forward slash (/) character in the Value Meta Characters tab.
    • Select newly created json profile from the "Header-Based Content Profiles" tab of the matching url.
      Security > Application Security > URLs > Allowed URLs > Allowed HTTP URLs > [URL] > Header-Based Content Profiles
      • Delete the line containing *json*.
      • Add new line:
        • Request Header Name: Content-Type
        • Request Header Value: *json*
        • Request Body Handling: JSON
        • Profile Name: [New json profile]

1 Reply

  • Enes_Afsin_Al's avatar
    Enes_Afsin_Al
    Icon for MVP rankMVP
    8 months ago

    Hi Jack3,

    • Create a new JSON profile.
      Security > Application Security > Content Profiles > JSON Profiles > Create New JSON Profile...
    • Edit the properties according to the JSON profile used by default.
    • Disable Parse Parameters option.
    • Allow forward slash (/) character in the Value Meta Characters tab.
    • Select newly created json profile from the "Header-Based Content Profiles" tab of the matching url.
      Security > Application Security > URLs > Allowed URLs > Allowed HTTP URLs > [URL] > Header-Based Content Profiles
      • Delete the line containing *json*.
      • Add new line:
        • Request Header Name: Content-Type
        • Request Header Value: *json*
        • Request Body Handling: JSON
        • Profile Name: [New json profile]