Web Application Firewall:Match conditions

Match Field

Logical Operator

Match Content

Description

URI Path

Contains

/login.php

The request matches this rule if the request path contains /login.php.

IP

Belongs to

192.1.XX.XX

The request matches this rule if the client IP is 192.1.XX.XX.

Match field

Description

Supported logical operators

URI

The Uniform Resource Identifier (URI) of a request, which indicates the path of the requested resource. Generally, URI = URI Path + Query String.

The corresponding match content starts with / and does not contain a domain name. For example, /login.php.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Length equals, Length is greater than, Length is less than

• Starts with, Ends with

• Regular Expression Match, Regular Expression Mismatch

IP

The source IP address of the request, that is, the IP address of the client that initiates the request.

Belongs To, Does Not Belong To

Referer

The source URL of the request, that is, the page from which the request was redirected.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Exists, Does not exist

• Is empty

• Length equals, Length is greater than, Length is less than

• Starts with, Ends with

• Regular Expression Match, Regular Expression Mismatch

User-Agent

The browser information of the client that initiates the request, including the browser identifier, rendering engine identifier, and version information.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Exists, Does not exist

• Is empty

• Length equals, Length is greater than, Length is less than

• Starts with, Ends with

• Regular Expression Match, Regular Expression Mismatch

Query String

The query string in the request, specifically the part after the question mark (?) in the URL.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Exists, Does not exist

• Length equals, Length is greater than, Length is less than

• Starts with, Ends with

• Regular Expression Match, Regular Expression Mismatch

Cookie

The cookie information in the request.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Exists, Does not exist

• Length equals, Length is greater than, Length is less than

• Regular Expression Match, Regular Expression Mismatch

Content-Type

The HTTP content type specified in the request, that is, the Multipurpose Internet Mail Extensions (MIME) type information.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Length equals, Length is greater than, Length is less than

• Regular Expression Match, Regular Expression Mismatch

Content-Length

The number of bytes contained in the request content. Valid values: 0 to 2147483648.

• Equals, Is greater than, Is less than

X-Forwarded-For

The actual IP address of the client in the request. The X-Forwarded-For (XFF) header field is used to identify the original IP address of the client for requests forwarded through HTTP proxies or load balancers. This field is included only in requests forwarded by HTTP proxies or load balancers.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does Not Contain

• Does Not Exist

• Length equals, Length is greater than, Length is less than

Body

The content information of the request.

• Equals

• Contains

• Does Not Exist

• Starts with, Ends with

• Regular Expression Match

Http-Method

The request method, including GET, POST, DELETE, PUT, OPTIONS, CONNECT, HEAD, TRACE, and PATCH.

• Equals, Does not equal, Equals one of, Does not equal any of

Header

The header information of the request. Custom header fields are supported.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Exists, Does not exist

• Length equals, Length is greater than, Length is less than

• Regular Expression Match, Regular Expression Mismatch

URI Path

The URI path of the request.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Length equals, Length is greater than, Length is less than

• Starts with, Ends with

• Regular Expression Match, Regular Expression Mismatch

Query String Parameter

The parameter name of the request parameter. The request parameter refers to the part after the question mark (?) in the request URL. For example, in www.aliyundoc.com/request_path?param1=a&param2=b, both param1 and param2 are request parameters.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Exists, Does not exist

• Is empty

• Length equals, Length is greater than, Length is less than

• Starts with, Ends with

Server-Port

The server port.

• Equals, Does not equal, Equals one of, Does not equal any of

File Extension

The file extension of the requested file, for example, .png and .php.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Exists, Does not exist

• Is empty

• Length equals, Length is greater than, Length is less than

• Starts with, Ends with

• Regular Expression Match, Regular Expression Mismatch

Filename

The filename at the end of the request path. For example, in /abc/index.php, index.php indicates the filename.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Exists, Does not exist

• Is empty

• Length equals, Length is greater than, Length is less than

• Starts with, Ends with

• Regular Expression Match, Regular Expression Mismatch

Host

The requested domain name.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Exists, Does not exist

• Is empty

• Length equals, Length is greater than, Length is less than

• Starts with, Ends with

• Regular Expression Match, Regular Expression Mismatch

Cookie Name

The key name of the cookie. For example, in the cookie acw_tc:111, acw_tc is the key name of the cookie.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Exists, Does not exist

• Is empty

• Length equals, Length is greater than, Length is less than

• Starts with, Ends with

• Regular Expression Match

Body Parameter

• Basic rules

  • This field is used to specify the parameter name in the request body. The match is case-sensitive.

  • The length of the match content must be greater than 4 characters. Otherwise, the system cannot detect the corresponding traffic.

• Format specification

  • Regular parameters: Enter the parameter key name directly. For example, if the request body is a=1&b=2, enter a or b.

  • Nested JSON: Use the dot-separated hierarchical format of ParentKey.ChildKey. For example, if you need to match the value in {"userInfo": {"userId": "12345"}}, enter userInfo.userId.

• Equals, Does not equal, Equals one of, Does not equal any of

• Contains, Does not contain, Contains one of, Does not contain any of

• Exists, Does not exist

• Is empty

• Length equals, Length is greater than, Length is less than

• Starts with, Ends with

• Regular Expression Match

Client-ID

The client identifier (such as a browser or application), which identifies the client from which an HTTP request originates based on characteristics such as User Agent information and traffic fingerprints.

• Contains, Does Not Contain

• Equals, Does Not Equal

• Equals One of Multiple Values

JA3 Fingerprint

A string generated by performing MD5 hashing on key parameters during the TLS handshake, including the TLS version, cipher suite, compression algorithm, and TLS extensions. This string represents the TLS configuration of the client and is called the JA3 fingerprint.

The JA3 fingerprint can be used to identify and distinguish different types of TLS clients, such as web browsers, mobile applications, and malware.

• Equals, Does Not Equal

• Equals One of Multiple Values

JA4 Fingerprint

The JA4 fingerprint introduces more contextual information and algorithms, such as the browser version and operating system, to reduce the potential duplication issues caused by the JA3 fingerprint.

The JA4 fingerprint can more accurately identify real users versus imposters, reducing the false positive rate.

• Equals, Does Not Equal

• Equals One of Multiple Values

HTTP/2 Fingerprint

An HTTP 2.0 fingerprint generated by processing the original fingerprint of the HTTP/2 client using the MD5 algorithm. It is used to analyze and identify different clients to achieve more secure and efficient communication.

• Equals, Does Not Equal

• Equals One of Multiple Values

IDC

Identifies the traffic source based on source IP attribution data. Cloud servers have lower costs and are easily exploited by malicious actors for attacks.

Equals One of Multiple Values, Does Not Equal Any Value

Web SDK

Identifies abnormal traffic based on probe information collected by Web SDK, such as the web UMID and the number of keyboard/mouse/touchscreen presses.

• Equals

• Value Greater Than, Value Less Than

App SDK

Enables fine-grained control based on probe information collected by App SDK.

• Contains, Does Not Contain

• Equals, Does Not Equal

• Length Less Than, Length Equal To, Length Greater Than

• Equals One of Multiple Values, Does Not Equal Any Value

• Contains One of Multiple Values, Does Not Contain Any Value

• Regular Expression Match, Regular Expression Mismatch

• Prefix Match, Suffix Match

• Exists, Does Not Exist

• Content Is Empty