You must add match conditions to rules when you configure a whitelist and customize protection policies for Web Application Firewall (WAF). This topic describes the fields that you can use in the match conditions and their descriptions.
Match conditions and actions
In the WAF console, you can customize rules for whitelists and protection policies. A custom rule consists of match conditions and actions. When you create a rule, you must specify the match fields, logical operators, and match content to add match conditions. You also need to select an action that is triggered when requests match the conditions you specify.
- Match conditions
Each match condition consists of a match field, logical operator, and match content. The match content does not support regular expressions. You can add a maximum of five match conditions to a custom rule, and the logical relation among the conditions is AND. The custom rule works only when all the match conditions are met.
- ActionWhen you configure a whitelist rule, you must select features for Modules Bypassing Check so that requests that meet match conditions bypass the corresponding checks. When you configure custom protection policies, you must select an action that is triggered for requests that meet match conditions. For more information, see the following topics:
Supported match fields
The following table lists the match fields that are supported in match conditions.
|Match field||Edition||Logical operator||Description|
|IP||Pro edition or higher||Has and Does not have||The source IP address of an access request. You can enter IP addresses or CIDR blocks,
for example, 18.104.22.168/24.
Note You can enter a maximum of 50 IP addresses or CIDR blocks. Separate them with commas (,).
|URL||Pro edition or higher||
||The URL of an access request.|
|Referer||Pro edition or higher||
||The URL of the source page from which the access request is redirected.|
|User-Agent||Pro edition or higher||
||The browser information of the client that initiates access requests. The information includes the browser, rendering engine, and version.|
|Params||Pro edition or higher||
||The parameter part in the request URL, usually the part that follows the question
mark (?) in the URL. For example, in
|Cookie||Business edition or higher||
||The cookie information in an access request.|
|Content-Type||Business edition or higher||
||The HTTP content type (MIME) in the response.|
|Content-Length||Business edition or higher||Value less than, Value equals, and Value more than||The number of bytes in the response.|
|X-Forwarded-For||Business edition or higher||
||The actual IP address of the client that initiates access requests. X-Forwarded-For (XFF) is an HTTP header field. It is used to identify the originating IP address of a client that connects to the server through an HTTP proxy or a Server Load Balancer (SLB) instance. XFF is only included in the access requests that are forwarded by the HTTP proxy or SLB instance.|
|Post-Body||Business edition or higher||
||The content of an access request.|
|Http-Method||Business edition or higher||Equals and Does not equal||The request method, such as GET, POST, DELETE, PUT, and OPTIONS.|
|Header||Business edition or higher||
||The header of an access request, which is used to customize the HTTP header.|
|URLPath||Business edition or higher||
||The URL path of an access request.|
|Has and Does not have||Whether the match field has the match content.|
|Includes and Does not include||Whether the match field includes the match content.|
|Equals and Does not equal||Whether the match field equals the match content.|
|Length equals, Length more than, and Length less than||The length of the match field is equal to, greater than, or less than that of the match content.|
|Does not exist||The match field does not exist.|
|Value less than, Value equals, and Value more than||The value of the match field is less than, equal to, or greater than that of the match content.|
|URI Path Match||The prefix of the match field contains the match content.|
|Regular Expression||The match field matches the regular expression defined in the match content.|