CDN:Configure a User-Agent blacklist or whitelist

Usage notes

• You can configure either a User-Agent blacklist or a whitelist, not both at the same time.

• If a request's User-Agent header matches a blacklisted value, the request still reaches the CDN point of presence (POP), but the POP denies it with a 403 status code and logs the request.

• Blocked malicious requests still generate a small amount of traffic fees because they consume processing resources on CDN nodes. If clients use HTTPS, fees for HTTPS requests are also incurred.

Procedure

1. Log on to the CDN console.

2. In the left navigation pane, click Domain Names.

3. On the Domain Names page, find the target domain name and click Manage in the Actions column.

4. In the domain's navigation pane, click Access Control.

5. Click the User-Agent Blacklist/Whitelist tab.

6. On the User-Agent Blacklist/Whitelist tab, click Modify.

7. Based on the on-screen instructions, configure a Blacklist or Whitelist for the User-Agent header.

   Parameter	Description
   Type	The list type. Blacklist If a request's User-Agent header matches a blacklisted value, access is denied and a 403 status code is returned. Whitelist Only requests whose User-Agent header matches a whitelisted value can access domain resources.
   Rules	Separate multiple User-Agent values with a vertical bar (|). Wildcards (*) are supported. Example: *curl*|*IE*|*chrome*|*firefox*. This feature requires an exact match and does not support substring matching. For example, curl/7.68.0 matches only requests whose User-Agent is exactly curl/7.68.0. To match all requests containing a specific keyword, enclose it in wildcards (*), such as *7.68.0* or *curl*. Note To control access for requests with an empty User-Agent header, use this-is-empty-ua to represent an empty User-Agent value. On a whitelist: If a rule includes this-is-empty-ua, requests with an empty User-Agent header are allowed. On a blacklist: If a rule includes this-is-empty-ua, requests with an empty User-Agent header are denied. The User-Agent blacklist/whitelist does not support access control for requests without a User-Agent header. To handle such requests, use EdgeScript. For more information, see EdgeScript. Alternatively, or submit a ticket to request a backend configuration.
   Rule Condition	A rule condition allows a rule to be applied only when a request meets specific criteria. Important When a feature references rule conditions, the execution order follows the priority of the associated rule conditions, not the order of the feature configurations. Do not use: Disables conditional rules. You can add or edit conditional rules in the Rules engine.

8. Click OK.

Configuration examples

• Example 1: Whitelist

  Rule: *IE*|*firefox*

  Result: Only requests from clients that identify as Internet Explorer or Firefox can access the resources. All other requests are denied.

• Example 2: Blacklist

  Rule: *IE*|this-is-empty-ua

  Result: Requests from clients that identify as Internet Explorer or requests with an empty User-Agent header are denied.

• Example 3: Blacklist (wildcard matching)

  Incorrect rule: curl/7.68.0

  Correct rule: *curl/7.68.0* or *7.68.0*

  The rule curl/7.68.0 does not work because the feature requires an exact match, not substring matching. To block all requests containing this string, use wildcards (*).