[ASM] : "Request length exceeds defined buffer size " - How to increase the limit ?

Forums Technical Forums
1

Hi Experts ,

WAF is rejecting the request because it exceeds the maximum allowed request size (10MB)

Requested URL : [HTTPS] /stock.option

Host : trade-it.ifund.com

Detected Request Length : 12005346 bytes ( 12 MB )

Expected Request Length : 10000000 bytes ( 10 MB )

How to increase the limit specific to this url/uri only ?

2

I am not aware of an option that does this for a specific URL.
My suggestion is to change the long_request_buffer_size as described in K01235989 and activate an iRule/LTM policy that blocks larger requests on all other URL and virtual servers (if needed).

Alternatively you can bypass the ASM for the path completely (K22021244)

3

Hi @Blue_whale ,

to my knowledge you cannot extend the limit per URL, but you can unblock a request which triggers this violation for a specific URL with an iRule:

when ASM_REQUEST_DONE {
    if {[ASM::violation names] contains "VIOLATION_REQUEST_TOO_LONG" and [string tolower [HTTP::uri]] starts_with "/stock.option"} {
        ASM::unblock        
    } 
}

Cheers

Daniel

4

Hello @Blue_whale

Via system variables you could do it. 
In my case environment I had to increase it.

-ASCapi

5

Yet I can not say if it recommended to change de default value. Of course if you’re sure that is false-positive so it takes sense

6

Good point @ASCapi . From my experience I can say that the default value is low. However I wouldn’t give any recommendation for a one-size-fits-all value to apply in any environment.

7

For some violations using Microservices is great to stop the violation just for specific fqdn hostname and URL. Only method for microservices can’t be selected as this may need Request For Enhancement .

8

Hi @ASCapi ,

Thank you for the reply .

Can you guide me how to change the system variable on GUI or on command line ..what is the command ?

9

@Blue_whale   on the link KB provides by @chrros95   you got all you need to change it.

As you like in CLI or GUI.

10

In my opinion, the best thing to do is to disable blocking for this.