Skip to content

Commit 2f5bf2d

Browse files
sylwangsylwang
committed
address feedback
1 parent a742530 commit 2f5bf2d

File tree

5 files changed

+174
-186
lines changed

5 files changed

+174
-186
lines changed

‎content/nginx-one/nap-integration/add-cookies.md‎

Lines changed: 0 additions & 59 deletions
This file was deleted.

‎content/nginx-one/nap-integration/add-parameters.md‎

Lines changed: 0 additions & 66 deletions
This file was deleted.

‎content/nginx-one/nap-integration/add-urls.md‎

Lines changed: 0 additions & 60 deletions
This file was deleted.

‎content/nginx-one/nap-integration/cookies-params-urls.md‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
---
2+
title: "Add cookies, parameters and urls"
3+
weight: 400
4+
toc: true
5+
nd-content-type: how-to
6+
nd-product: NGINX One Console
7+
---
8+
9+
# Add cookies
10+
Cookies can be configured and managed directly within the policy editor by selecting the **Cookies** option.
11+
12+
## Cookie properties and types
13+
Each cookie configuration includes:
14+
- `Cookie Type`: `Explicit` or `Wildcard`. For details on explicit and wildcard matching, see the [Matching Types: Explicit vs Wildcard]({{< ref "/nginx-one/nap-integration/waf-policy-matching-types.md" >}}) section.
15+
- `Cookie Name`: The name of the cookie to be monitored or protected
16+
- `Enforcement Type`:
17+
- **Allow**: Permits the cookie with optional attack signature checks
18+
- **Disallow**: Blocks the use of the cookie entirely
19+
- `Attack Signatures`: Indicates whether attack signatures and threat campaigns are enabled, disabled, or not applicable
20+
- `Mask Value in Logs`: When enabled, the cookie's value will be masked in the request log for enhanced security and privacy
21+
22+
**⚠️ Important:** Attack Signatures are automatically set to "Not Applicable" when Enforcement Type is set to `Disallow` since the URL is explicitly blocked and signature checking is unnecessary.
23+
24+
For a complete list of configurable cookie properties and options, see the [Cookie Configuration Parameters]({{< ref "/waf/policies/parameter-reference.md" >}}) documentation under the `cookies` section.
25+
26+
## Cookie violations
27+
Click on **Edit Configuration** to configure cookie violations. The following violations can be configured for cookies:
28+
29+
- `VIOL_COOKIE_EXPIRED`: Triggered when a cookie's timestamp is expired
30+
- `VIOL_COOKIE_LENGTH`: Triggered when cookie length exceeds the configured limit
31+
- `VIOL_COOKIE_MALFORMED`: Triggered when cookies are not RFC-compliant
32+
- `VIOL_COOKIE_MODIFIED`: Triggered when domain cookies have been tampered with
33+
34+
For each violation type, you can:
35+
- Set the enforcement action
36+
- Toggle `alarm` and `block` settings
37+
38+
For more details about enforcement modes, see the [Glossary]({{< ref "/nginx-one/glossary.md#nginx-app-protect-waf-terminology" >}}), specifically the entry: **Enforcement mode**.
39+
40+
See the [Supported Violations]({{< ref "/waf/policies/violations.md#supported-violations" >}}) for additional details.
41+
42+
# Adding a cookie to your policy
43+
44+
1. Choose Cookie Type:
45+
- Select either `Explicit` for exact cookie matching or `Wildcard` for pattern-based matching
46+
47+
1. Configure Basic Properties:
48+
- Enter the `Cookie Name`
49+
- Choose whether to mask the cookie value in logs
50+
51+
1. Set Enforcement:
52+
- Choose whether to allow or disallow the cookie
53+
- If `Allow Cookie` is selected, you can optionally enable attack signatures
54+
- **⚠️ Important:** Attack signatures cannot be enabled for disallowed cookies.
55+
56+
1. Optional: Configure Attack Signatures
57+
- If enabled, you can overwrite attack signatures for this specific cookie
58+
- For details on signature configuration, refer to the documentation on [Add Signature Sets]({{< ref "/nginx-one/nap-integration/add-signature-sets.md/" >}})
59+
60+
1. Select **Add Cookie** to save your configuration
61+
62+
# Add parameters
63+
Parameters can be configured and managed directly within the policy editor by selecting the **Parameters** option.
64+
65+
## Parameter properties and types
66+
Each parameter configuration includes:
67+
- `Parameter Type`: `Explicit` or `Wildcard`. For details on explicit and wildcard matching, see the [Matching Types: Explicit vs Wildcard]({{< ref "/nginx-one/nap-integration/waf-policy-matching-types.md" >}}) section.
68+
- `Name`: The name of the parameter
69+
- `Location`: Where the parameter is expected (URL query string, POST data, etc.)
70+
- `Value Type`: The expected type of the parameter value (e.g., alpha-numeric, integer, email)
71+
- `Attack Signatures`: Whether attack signature checking is enabled for this parameter
72+
- `Mask Value in Logs`: When enabled, the parameter's value will be masked in the request log for enhanced security and privacy
73+
74+
For a complete list of configurable cookie properties and options, see the [Parameter Configuration Parameters]({{< ref "/waf/policies/parameter-reference.md" >}}) documentation under the `parameters` section.
75+
76+
## Parameter violations
77+
Select **Edit Configuration** to configure parameter violations. The following violations can be configured for parameters:
78+
79+
- `VIOL_PARAMETER`: Triggered when an illegal parameter is detected
80+
- `VIOL_PARAMETER_ARRAY_VALUE`: Triggered when an array parameter value is illegal
81+
- `VIOL_PARAMETER_DATA_TYPE`: Triggered when parameter data type doesn't match configuration
82+
- `VIOL_PARAMETER_EMPTY_VALUE`: Triggered when a parameter value is empty but shouldn't be
83+
- `VIOL_PARAMETER_LOCATION`: Triggered when a parameter is found in wrong location
84+
- `VIOL_PARAMETER_NAME_METACHAR`: Triggered when illegal meta characters are found in parameter name
85+
- `VIOL_PARAMETER_NUMERIC_VALUE`: Triggered when numeric parameter value is outside allowed range
86+
- `VIOL_PARAMETER_REPEATED`: Triggered when a parameter name is repeated illegally
87+
- `VIOL_PARAMETER_STATIC_VALUE`: Triggered when a static parameter value doesn't match configuration
88+
- `VIOL_PARAMETER_VALUE_LENGTH`: Triggered when parameter value length exceeds limits
89+
- `VIOL_PARAMETER_VALUE_METACHAR`: Triggered when illegal meta characters are found in parameter value
90+
- `VIOL_PARAMETER_VALUE_REGEXP`: Triggered when parameter value doesn't match required pattern
91+
92+
For each violation type, you can:
93+
- Set the enforcement action
94+
- Toggle `alarm` and `block` settings
95+
96+
For more details about enforcement modes, see the [Glossary]({{< ref "/nginx-one/glossary.md#nginx-app-protect-waf-terminology" >}}), specifically the entry: **Enforcement mode**.
97+
98+
See the [Supported Violations]({{< ref "/waf/policies/violations.md#supported-violations" >}}) for additional details.
99+
100+
# Adding a parameter to your policy
101+
102+
1. Choose Parameter Type:
103+
- Select either `Explicit` for exact parameter matching or `Wildcard` for pattern-based matching
104+
105+
1. Configure Basic Properties:
106+
- Enter the parameter `Name`
107+
- Select the `Location` where the parameter is expected
108+
- Choose the `Value Type` (alpha-numeric, integer, email, etc.)
109+
- Set the `Data Type` if applicable
110+
111+
1. Set Security Options:
112+
- Choose whether to enable attack signatures
113+
- Decide if parameter value should be masked in logs which sets `sensitiveParameter` in [Parameter Configuration Reference]({{< ref "/waf/policies/parameter-reference.md" >}})
114+
115+
1. Optional: Configure Attack Signatures
116+
- If enabled, you can overwrite attack signatures for this specific parameter
117+
- For details on signature configuration, refer to the documentation on [Add Signature Sets]({{< ref "/nginx-one/nap-integration/add-signature-sets.md/" >}})
118+
119+
1. Select **Add Parameter** to save your configuration
120+
121+
# Add urls
122+
URLs can be configured and managed directly within the policy editor by selecting the **URLs** option.
123+
124+
## URL properties and types
125+
Each URL configuration includes:
126+
- `URL Type`: `Explicit` or `Wildcard`. For details on explicit and wildcard matching, see the [Matching Types: Explicit vs Wildcard]({{< ref "/nginx-one/nap-integration/waf-policy-matching-types.md" >}}) section.
127+
- `Method`: Specifies which HTTP methods are allowed (`GET`, `POST`, `PUT`, etc.)
128+
- `Protocol`: The protocol for the URL (`HTTP`/`HTTPS`)
129+
- `Enforcement Type`:
130+
- **Allow**: Permits access to the URL with optional attack signature checks
131+
- **Disallow**: Blocks access to the URL entirely
132+
- `Attack Signatures`: Indicates whether attack signatures and threat campaigns are enabled, disabled, or not applicable
133+
134+
**⚠️ Important:** Attack Signatures are automatically set to "Not Applicable" when Enforcement Type is set to `Disallow` since the URL is explicitly blocked and signature checking is unnecessary.
135+
136+
For a complete list of configurable URL properties and options, see the [URL Configuration Parameters]({{< ref "/waf/policies/parameter-reference.md" >}}) documentation under the `urls` section.
137+
138+
## URL violations
139+
Select **Edit Configuration** to configure URL violations. The following violations can be configured for URLs:
140+
141+
- `VIOL_URL`: Triggered when an illegal URL is accessed
142+
- `VIOL_URL_CONTENT_TYPE`: Triggered when there's an illegal request content type
143+
- `VIOL_URL_LENGTH`: Triggered when URL length exceeds the configured limit
144+
- `VIOL_URL_METACHAR`: Triggered when illegal meta characters are found in the URL
145+
146+
For each violation type, you can:
147+
- Set the enforcement action
148+
- Toggle `alarm` and `block` settings
149+
150+
For more details about enforcement modes, see the [Glossary]({{< ref "/nginx-one/glossary.md#nginx-app-protect-waf-terminology" >}}), specifically the entry: **Enforcement mode**.
151+
152+
See the [Supported Violations]({{< ref "/waf/policies/violations.md#supported-violations" >}}) for additional details.
153+
154+
# Adding a URL to your policy
155+
156+
1. Choose URL Type:
157+
- Select either `Explicit` for exact URL matching or `Wildcard` for pattern-based matching
158+
159+
1. Configure Basic Properties:
160+
- Enter the `URL` path
161+
- Select allowed `Method(s)` (e.g., `GET`, `POST`, *)
162+
- Choose the `Protocol` (`HTTP`/`HTTPS`)
163+
164+
1. Set Enforcement:
165+
- Choose whether to allow or disallow the URL
166+
- If `Allow URL` is selected, you can optionally enable attack signatures
167+
- **⚠️ Important:** Attack signatures cannot be enabled for disallowed URLs.
168+
169+
1. **Optional**: Configure Attack Signatures
170+
- If enabled, you can overwrite attack signatures for this specific URL
171+
- For details on signature configuration, refer to the documentation on [Add Signature Sets]({{< ref "/nginx-one/nap-integration/add-signature-sets.md/" >}})
172+
173+
1. Select **Add URL** to save your configuration

‎content/nginx-one/nap-integration/review-policy.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# We use sentence case and present imperative tone
33
title: "Review policy"
44
# Weights are assigned in increments of 100: determines sorting order
5-
weight: 300
5+
weight: 500
66
# Creates a table of contents and sidebar, useful for large documents
77
toc: false
88
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this

0 commit comments

Comments
 (0)