Forum Discussion

swo0sh_gt_13163's avatar
swo0sh_gt_13163
Icon for Altostratus rankAltostratus
Jan 18, 2015

JSON & XML with ASM

Hello Pros,

 

I have got a 11.2.1 HF13 BIG-IP, and need to parse JSON data for input validation using ASM. However I am confuse with XML. Is it necessary to use XML when ASM is parsing only JSON data for input validation?

 

What are the dependencies on Developers to configure JSON profile in ASM? I mean do I need any sort of WSDL file which we generally use with XML profile? Any best practices to be followed?

 

Thank you, Darshan

 

ASM Advanced WAF
JSON
security
xml

3 Replies

  • Arnaud_Lemaire's avatar
    Arnaud_Lemaire
    Icon for Employee rankEmployee
    Jan 19, 2015

    Hi, JSON profile doesn't need xml. It's using it's own non structured format. By unstructured i mean there is not schema like WSDL so far, discussion are ongoing (from community and normalization org) to provide a describer like synthax. As well we are not able to white list attributes and attribute's types. The parser we provide is pretty simple : buffer overflow limitations, format control (meaning do we have the right number of curly-brace and other formating ...) meta caracters allowed and signatures.

     

  • swo0sh_gt_13163's avatar
    swo0sh_gt_13163
    Icon for Altostratus rankAltostratus
    Jan 19, 2015

    Thanks Arnaud,

     

    Does it mean that I just need to create a JSON Profile and associate with an existing URL/Parameter? In case if violation, you may exclude a particular signature from the JSON policy signatures, right?

     

    • Arnaud_Lemaire's avatar
      Arnaud_Lemaire
      Icon for Employee rankEmployee
      Jan 19, 2015
      yes, main maintenance tasks are to add/remove violations and met car.