For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Greg_33558's avatar
Greg_33558
Icon for Nimbostratus rankNimbostratus
Aug 27, 2013

How to support multiple XML schemas in ASM?

We have an XML-over-HTTP web service which we are attempting to protect with the ASM. The problem I am finding is that there are multiple versions of the API, each of which has minor incompatibiliti...
ASM Advanced WAF
design
schema
security
xml
gowenfawr's avatar
gowenfawr
Icon for Nimbostratus rankNimbostratus
Aug 29, 2013

I figured it out. Header-Based Content Profiles in the Allowed URL Properties:

 

 

Just enter multiple entries for (in my case) Content-Type as the Request Header Name and the different version tags go into the Request Header Value. Parse as XML, and use a different XML Profile with each. Each XML Profile has a different version .XSD attached to it. So, if the ASM sees HTTP header "Content-Type: application/com.foobar.api-v2+xml", it will use the provision_api_v2 profile which uses v2 of the XML XSD when parsing it.

 

Can be verified by the ASM request logs - if there is an XML schema violation and you click for details, it will list the XML Profile that was used when determining the violation: