AWAF Path Parameters with OPENAPI json file

Question

Hi,&nbsp; Iam securing a API with a JSON OPENAPI file&nbsp; it mostly works fine however I have two positional parameters used in one url that seems to mask the following paths "/dqm/v1/projects/{customerId}/{pageNumber}&nbsp; &amp;&nbsp;/dqm/v1/projects/projectDetails/{workRequestId}" The result is illegal parameter length violations on a url that is actually valid. the two paths have different operationId headers associated with them Does the WAF use the operationId to match the Path? It appears not as if I delete the operation Id from the api file then the policy matches the correct URL.Any assistance in ubderstanding what is happening and why is appreaciated.Allowed URL's&nbsp;extract from JSON openAPI file/dqm/v1/projects/{customerId}/{pageNumber}:get:tags:- customer-projects-controlleroperationId: getCustomerProjectsForIdperPageparameters:- name: customerIdin: pathrequired: trueschema:type: string- name: pageNumberin: pathrequired: trueschema:type: stringresponses:'200':description: OKcontent:'*/*':schema:$ref: '#/components/schemas/CustomerProjectsResponse'/dqm/v1/projects/projectDetails/{workRequestId}:get:tags:- customer-projects-controlleroperationId: getProjectDetailswithIDparameters:- name: workRequestIdin: pathrequired: trueschema:type: stringresponses:'200':description: OKcontent:'*/*':schema:$ref: '#/components/schemas/ProjectDetailsResponse'

christhuys · Accepted Answer

The resolution to this issue is to use the WildCards Order TAB to set the order the URLS should be processed.&nbsp;

nikoolayy1 · Answer

Good question! Never needed to do positional parameters, so I am also wondering.
&nbsp;
Have you tried making manual policy with positional parameters and then to export it in JSON to see how it looks and if you can then use this in the OPENAPI/SWAGGER file as to see if it is supported (as a note your file is YAML not Json but that is just the look)&nbsp; https://support.f5.com/csp/article/K52644614
&nbsp;
F5 XC/distributed cloud has SWAGGER/OPENAPI discovery but that can't be done with on-prem appliance 😯
&nbsp;
https://community.f5.com/t5/technical-articles/api-discovery-and-auto-generation-of-swagger-schema/ta-p/278614

nikoolayy1 · Answer

Now I see what you mean and I even saw an article when you mentioned that the wildcard url order was the issue.
K13220614: The BIG-IP ASM system may not enforce wildcard URLs that are created without the wildcard order specified
https://support.f5.com/csp/article/K13220614
&nbsp;

chris_thuys · Answer

Sometimes it's all about the keywords you search on. Mine were all wrong. I was focused on the jSON&nbsp; file rather than the Wildcard URL's.

nikoolayy1 · Answer

By the way&nbsp;ChrisThuys&nbsp;/&nbsp;Chris_Thuys&nbsp; I seem to found a workaround as for example if you create the policy from the start like the one below it will result in the following order but you need to create asm policy from the start with the correct order as if you modify the openapi/swagger file it may not change the order.
&nbsp;
Outside of that I am trying to use positional parameters as to trigger wildcard url match and still figuring out if wildcard parameter names are supported by F5 AWAF/ASM when importing a swagger/openapi file. I do not know if you have tried this as well.
&nbsp;

&nbsp;
&nbsp;
&nbsp;
&nbsp; "paths": {
&nbsp; &nbsp; &nbsp; "/{path}": {
 &nbsp; "get": {
&nbsp; &nbsp; &nbsp; &nbsp; "description": "Returns a user based on a single ID, if the user does not have access to the pet",
&nbsp; &nbsp; &nbsp; &nbsp; "operationId": "findPetById",
&nbsp; &nbsp; &nbsp; &nbsp; "produces": [
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "application/json",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "application/xml",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "text/xml",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "text/html"
&nbsp; &nbsp; &nbsp; &nbsp; ],
&nbsp; &nbsp; &nbsp; &nbsp; "parameters": [
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "name": "path",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "in": "path",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "description": "ID of pet to fetch",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "required": true,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "type": "string"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; ],
&nbsp; &nbsp; &nbsp; &nbsp; "responses": {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "200": {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "description": "pet response",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "schema": {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "$ref": "#/definitions/Pet"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "default": {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "description": "unexpected error",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "schema": {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "$ref": "#/definitions/ErrorModel"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; }
 &nbsp; }
&nbsp; &nbsp; },
&nbsp; &nbsp; &nbsp; "/{path1}/{path2}": {
 &nbsp; "get": {
&nbsp; &nbsp; &nbsp; &nbsp; "description": "Returns a user based on a single ID, if the user does not have access to the pet",
&nbsp; &nbsp; &nbsp; &nbsp; "operationId": "findPetById",
&nbsp; &nbsp; &nbsp; &nbsp; "produces": [
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "application/json",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "application/xml",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "text/xml",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "text/html"
&nbsp; &nbsp; &nbsp; &nbsp; ],
&nbsp; &nbsp; &nbsp; &nbsp; "parameters": [
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "name": "path1",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "in": "path",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "description": "ID of pet to fetch",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "required": true,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "type": "string"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },
 &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "name": "path2",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "in": "path",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "description": "ID of pet to fetch",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "required": true,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "type": "string"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; ],
&nbsp; &nbsp; &nbsp; &nbsp; "responses": {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "200": {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "description": "pet response",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "schema": {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "$ref": "#/definitions/Pet"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "default": {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "description": "unexpected error",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "schema": {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "$ref": "#/definitions/ErrorModel"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; }
 &nbsp; }
&nbsp; &nbsp; }
&nbsp; },

Forum Discussion

AWAF Path Parameters with OPENAPI json file

5 Replies

https://support.f5.com/csp/article/K13220614

Recent Discussions

Client certificate Authentication - open multiple tabs

google autenticator broken barcode

Chrome V 124+ on MacOS - Virtual Server Access Issue

vulnerabilities (CVE-2020-36363), CVE-2016-0736,CVE-2019-6593-FOR VERSION BIGIP LTM-16.1.4

Port Group on F5OS network setting

Related Content

Getting started with WAF Policy automation on BIG-IP AWAF

AWAF subscription

Secure Your Epic Applications in a Flash with F5 FAST Templates & Declarative AWAF Policies

F5 ICAP over SSL/TLS (Secure ICAP) with F5 ASM/AWAF Antivirus Protection feature

F5 ASM/AWAF Remote File Inclusion signatures do not block http:// or https:// in the form parameter