Web Application Firewall:WAF 3.0 Data and Operational Security and Compliance Statement

Security and compliance for CNAME access

• If your origin server is deployed in the Chinese mainland, you must activate a WAF instance in the Chinese mainland and complete the ICP filing for your domain name before adding the domain name to WAF using a CNAME record.

To learn how to add a domain name by using a CNAME record, see Protect a website by using a CNAME record.

• If your origin server is deployed outside the Chinese mainland, activate a WAF instance outside the Chinese mainland. WAF is available in China (Hong Kong), Singapore, Dubai, Japan (Tokyo), Malaysia (Kuala Lumpur), Indonesia (Jakarta), US (Silicon Valley), and Germany (Frankfurt). If your origin server is in a region where WAF is not available, WAF routes your traffic to the WAF cluster in Singapore.

Cross-border data transfer

• Using the CNAME access feature of WAF transfers your business data to the region that you select or the region where the product is deployed. This may involve cross-border data transfer.

• You agree and confirm that you have full rights to manage this business data and are solely responsible for its transfer.

• You must ensure that your data transfer complies with all applicable laws. This includes implementing adequate data security technologies and policies, and fulfilling legal obligations such as obtaining explicit consent from individuals and completing data export security assessments and declarations. You also agree that your business data does not contain any content that is restricted or prohibited from being transferred or disclosed under applicable laws.

• If you fail to comply with the preceding statements and warranties, you are responsible for the corresponding legal consequences and liable for any losses incurred by Alibaba Cloud or its affiliates.

To avoid issues with cross-border data transfer, you can connect to WAF in cloud native mode or hybrid cloud mode.

Handling of non-standard ports

Scanners may flag domain names connected to WAF via a CNAME record as high-risk because they appear to listen on ports other than 80 and 443. Alibaba Cloud WAF only forwards data for ports that are configured in the console and only after a successful TCP three-way handshake. For unconfigured ports, WAF immediately sends an RST packet to close the connection after the handshake, so no data is forwarded. The ports identified as high-risk by scanners do not pose an actual security risk.

Supported cipher suites

When you protect your HTTPS services by using a CNAME record, an ECS instance, or a Layer 4 CLB (TCP) instance, you can customize the cipher suites WAF uses to match those supported by your origin server. This ensures WAF only accepts requests from clients that support the specified cipher suites. For a detailed list of supported cipher suites, see Supported cipher suites.

Log storage

Simple Log Service for WAF helps you collect and store web access logs and mitigation logs for protected objects, such as cloud service instances and domain names. Built on Alibaba Cloud Simple Log Service, this feature provides query and analysis, statistical charts, alerts, and integration with downstream computing and delivery services, allowing you to focus on analysis instead of tedious data querying and organization.

By default, Simple Log Service for WAF is disabled. If you need to store and analyze log data for your protected objects, you must first enable the service. When you enable it, you can select a region to store the logs.

For information about how to configure and use Simple Log Service for WAF and its billing, see Log Management. For information about compliance issues related to cross-Logstore queries, see Query logs across Logstores.

Cookie insertion

WAF inserts cookies into traffic for protected services in the following three scenarios.

Scenario 1: When you use features such as CC protection and scan protection, for requests that do not contain the acw_tc cookie, WAF inserts the acw_tc cookie into the response by default.

WAF inserts a cookie into clients, such as browsers, to differentiate and track them. When a client accesses your website, the HTTP request includes this cookie. WAF uses the cookie, along with your configured HTTP flood protection, session-based scan protection, and session-based custom frequency control rules, to detect HTTP flood attacks.

To disable cookie insertion in this scenario, log on to the WAF console, and in the top navigation bar, select the resource group and region of your WAF instance. Then, navigate to Protection Config > Protected Objects > Settings and configure the Cookie Settings, as shown in the following figure, to disable cookie insertion for a specific cloud service instance or domain name.

For more information about cookie settings, see Configure protected objects and protected object groups.

Scenario 2: You have configured a scenario-specific module for bot management for the cloud service instance or domain name, and enabled automatic web SDK integration.

When you configure a scenario-specific bot management template and enable automatic web SDK integration, WAF inserts the ssxmod_itna, ssxmod_itna2, and ssxmod_itna3 cookies into the HTTP header to collect the client's browser fingerprint. The collected fingerprint includes information such as the Host field from the HTTP header, and the browser's height and width.

To disable cookie insertion in this scenario, you must disable the corresponding scenario-specific bot management template. For more information, see Bot management (Legacy).

Scenario 3: You have configured custom rules or bot management for the cloud service instance or domain name, with the rule action set to JS challenge or slider challenge.

When traffic matches a rule, WAF issues a JS challenge or slider challenge to the client. If the client passes the challenge, WAF inserts the acw_sc__v2 or acw_sc__v3 cookie into the HTTP header to mark the client as verified.

To disable cookie insertion in this scenario, go to Mitigation Settings> Protection Features or Protection Config > Scenario-specific Protection> Bot Management > Scenario-specific Protection and disable the corresponding protection rule or policy. For more information about the JavaScript Validation and CAPTCHA actions, see Custom rules or Bot management (Legacy).

Data collection for app protection

WAF provides a software development kit (SDK) for native apps (Android and iOS) to enhance app protection. Once integrated, the SDK collects client-side risk features and generates a security signature that is included in requests. WAF uses this signature to identify and block malicious requests.