Web Application Firewall:Configure website tamper-proofing rules

Limitations

This feature does not support protected objects that use hybrid cloud mode or cloud native mode (MSE, FC).

Prerequisites

• You have an active Pay-as-you-go WAF 3.0 service.

• You have added your web services to WAF 3.0 as protected objects and protected object groups.

Step 1: Create a website tamper-proofing template

The website tamper-proofing module does not provide a default protection template. To use website tamper-proofing, you must create a new protection template and then add rules to it.

1. Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.

2. In the navigation pane on the left, choose Protection Config > Core Web Protection.

3. On the Core Web Protection page, find the Website Tamper-proofing section and click Create Template.

4. In the Create Template panel, configure the parameters and click OK.

   Parameter	Description
   Template Name	Enter a name for the template. The name must be 1 to 255 characters in length and can contain Chinese characters, uppercase and lowercase letters, digits, periods (.), underscores (_), and hyphens (-).
   Rule Configuration	Click Create Rule to create a website tamper-proofing rule for the template. You can also skip this step and create rules later. For more information, see Step 2: Add a website tamper-proofing rule to a protection template.
   Apply To	Select the Protected Objects and Protected Object Groups to apply the template to. You can associate a protected object or protected object group with only one template from the same protection module. For more information about how to add a protected object or protected object group, see Configure protected objects and protected object groups.

   A new protection template is enabled by default. In the protection template list, perform the following operations:

   • View the number of Protected Object/Group associated with the template.

   • Use the Status to enable or disable the template.

   • Click Create Rule to create a new rule for the template.

   • Edit, Delete, or Copy the protection template.

   • Click the icon next to the template name to view information about the rules in the protection template.

Step 2: Add a website tamper-proofing rule

A website tamper-proofing template takes effect only after you add rules to it. If you have already added rules when you created the template, you can skip this step.

1. Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.

2. In the navigation pane on the left, choose Protection Config > Core Web Protection.

3. In the Website Tamper-proofing section, find the protection template and click Create Rule in its Actions column.

4. In the Create Rule dialog box, configure the parameters and click OK.

   Parameter	Description
   Rule Name	Enter a name for the rule. The name can be up to 30 characters in length and can contain Chinese characters, letters, digits, and underscores (_).
   Address of Cached Page	Set the protocol and full path of the page that you want to cache. Protocol: http or https. Path of the cached page: The default value is www.waftest.cn/index.html. You can change the value. Wildcards, such as /*, and parameters are not supported. For example, in /abc?xxx=yyy, xxx=yyy is a parameter. Important Requests that contain URL parameters do not match the tamper-proofing rule and are forwarded to the origin server by WAF. For example, if the cached page path is set to /abc and the request URL is /abc?xxx=yyy, the request will not match the tamper-proofing rule for the cached page path /abc. The file at the specified path, which can be a TXT, HTML, image, or other file type, is protected. The size of a single protected file cannot exceed 1 MB. Important Only a specified URL can be cached. Directories are not supported.
   Specify User-Agent to Access	Specify the User-Agent header that WAF uses when it fetches the page from the origin server. If you do not select Specify User-Agent to Access, the User-Agent defaults to a PC browser identifier. If you select Specify User-Agent to Access, you must specify a User-Agent. You can open a browser and press F12 to open the developer tools. On the Network tab, click a request. In the HTTP Header section, find the User-Agent field to get the browser identifier.

   Note

   • After you create a website tamper-proofing rule, the system immediately fetches the resource and caches it in WAF. WAF serves subsequent requests from the cache.

   • Verify whether a request matches a tamper-proofing rule: You can use your browser's developer tools to confirm whether a request matches a tamper-proofing rule.

     1. Press F12 to open the developer tools.

     2. Switch to the Network tab.

     3. Visit the protected page and click the corresponding request.

     4. In the Response Headers section, check the following headers:

        • Aliwaf-Cache: If the value is HIT, the request matched a website tamper-proofing rule and WAF returned a cached page.

        • Server: If the value is Tengine, WAF proxied the request. This header appears only when you connect a domain name to WAF. WAF does not add this header in CLB access mode.

     If the Aliwaf-Cache header does not exist or its value is not HIT, the request did not match the rule. Check that the rule is configured correctly and enabled.

   • If you enable the Status again or activate a rule's Status, the system re-accesses the tamper-proofed resources and refreshes the cache. This has the same effect as manually clicking Update Cache.

   • If your origin server uses a whitelist for access control, add the following WAF IP addresses to the whitelist:

     • Mainland China: 121.196.106.101, 121.196.100.214, 121.196.110.192, and 121.196.107.0.

     • Outside Mainland China: 8.219.104.2 and 8.219.41.212.

   A new rule is enabled by default. In the rule list, perform the following operations:

   • View information such as the Rule ID and Rule Condition.

   • Use the Status switch to enable or disable the rule.

   • Edit or Delete the rule.

Related operations

To protect a specific directory on your server, use the web tamper proofing feature of Security Center. For more information, see web tamper proofing.

References

• For more information about protected objects, protection modules, and protection workflows in WAF 3.0, see Overview of protection configuration.

• To create a protection template by using the API, see CreateDefenseTemplate.

• To create and configure a Core Web Protection rule, see Create a Core Web Protection rule.