AWAF Brute Force protection not working for HTML Web application

[Abouja]

Hi Team,

I have configured login page and Brute force protection for my web application but it is not working:

The content-type of the request is Content-Type: application/x-www-form-urlencoded
below is the configuration of Login page with HTML form authentication type:

this is the inspection result of the login page:

We need your support please.

Thanks,

Ahmed

[Mohamed_Salah_]

Hello Ahmed,

Please make sure that the brute force settings in the learning and blocking settings is enabled, (blocked).

and modify the brute force profile and select the login page created in the ASM policy inside the brute force protection. if you have finished these steps, you can start changing the login condition:

• for example try expected status code "302" as the response was 302.
• or unexpected status code, for example "200"
• Or unexpected string in the response and check for a string that shows when you login with wrong credntials, for example "login failed".

All of these results (expected and unexpected) can be found in the developer tool inside the response and headers tab.