Skip to content

Commit fd22e59

Browse files
sylwangsylwang
committed
add instructions for urls/cookies/parameters
1 parent 0b1006a commit fd22e59

File tree

6 files changed

+217
-0
lines changed

6 files changed

+217
-0
lines changed

‎content/includes/nginx-one/nap-policy-matching-types.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Matching Types: Explicit vs Wildcard
2+
3+
In F5 WAF for NGINX (formerly known as NGINX App Protect WAF), matching can be defined in two ways:
4+
5+
## Explicit Matching
6+
Explicit matching refers to direct matches to specific names or paths in your application. For example:
7+
- URLs: `/index.html`, `/api/data`
8+
- Cookies: `sessionId`, `userPrefs`
9+
- Parameters: `username`, `email`
10+
11+
Use explicit matching when you need to protect specific, known entities.
12+
13+
## Wildcard Matching
14+
Wildcard matching uses patterns to match multiple similar names or paths. For example:
15+
- URLs: `/test*` matches `/test`, `/test123`, `/testing`
16+
- Cookies: `test*` matches `test`, `test123`, `testing`
17+
- Parameters: `user*` matches `username`, `user_id`, `userEmail`
18+
19+
Wildcard matching is useful when:
20+
- You need to protect multiple similar entities
21+
- You want to apply the same security controls to a group
22+
- The exact names or paths may vary or are dynamically generated
23+
24+
Both explicit and wildcard matching allow you to configure additional properties, such as enforcement type, attack signatures, and more, depending on the entity being protected.

‎content/nginx-one/nap-integration/add-cookies.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Managing Cookies in NAP Policy
2+
Cookies can be configured and managed directly within the policy editor by selecting the **Cookies** option.
3+
4+
## Cookie Properties and Types
5+
Each cookie configuration includes:
6+
- `Cookie Type`: `Explicit` or `Wildcard`. For details on explicit and wildcard matching, see the [Matching Types: Explicit vs Wildcard]({{< ref "/nginx-one/nap-policy-matching-types.md" >}}) section.
7+
- `Cookie Name`: The name of the cookie to be monitored or protected
8+
- `Enforcement Type`:
9+
- **Allow**: Permits the cookie with optional attack signature checks
10+
- **Disallow**: Blocks the use of the cookie entirely
11+
- `Attack Signatures`: Indicates whether attack signatures and threat campaigns are enabled, disabled, or not applicable
12+
- `Mask Value in Logs`: When enabled, the cookie's value will be masked in the request log for enhanced security and privacy
13+
14+
**⚠️ Important:** Attack Signatures are automatically set to "Not Applicable" when Enforcement Type is set to `Disallow` since the URL is explicitly blocked and signature checking is unnecessary.
15+
16+
For a complete list of configurable cookie properties and options, see the [Cookie Configuration Parameters]({{< ref "/waf/policies/parameter-reference.md" >}}) documentation under the `cookies` section.
17+
18+
## Cookie Violations
19+
Click on **Edit Configuration** to configure cookie violations. The following violations can be configured for cookies:
20+
21+
- `VIOL_COOKIE_EXPIRED`: Triggered when a cookie's timestamp is expired
22+
- `VIOL_COOKIE_LENGTH`: Triggered when cookie length exceeds the configured limit
23+
- `VIOL_COOKIE_MALFORMED`: Triggered when cookies are not RFC-compliant
24+
- `VIOL_COOKIE_MODIFIED`: Triggered when domain cookies have been tampered with
25+
26+
For each violation type, you can:
27+
- Set the enforcement action
28+
- Toggle `alarm` and `block` settings
29+
30+
For more details about enforcement modes, see the [Glossary]({{< ref "/nginx-one/glossary.md#nginx-app-protect-waf-terminology" >}}), specifically the entry: **Enforcement mode**.
31+
32+
# Adding a Cookie to Your Policy
33+
34+
1. Choose Cookie Type:
35+
- Select either `Explicit` for exact cookie matching or `Wildcard` for pattern-based matching
36+
37+
2. Configure Basic Properties:
38+
- Enter the `Cookie Name`
39+
- Choose whether to mask the cookie value in logs
40+
41+
3. Set Enforcement:
42+
- Choose whether to allow or disallow the cookie
43+
- If `Allow Cookie` is selected, you can optionally enable attack signatures
44+
45+
**⚠️ Important:** Attack signatures cannot be enabled for disallowed cookies.
46+
47+
4. Optional: Configure Attack Signatures
48+
- If enabled, you can overwrite attack signatures for this specific cookie
49+
- For details on signature configuration, refer to the documentation on [Add Signature Sets]({{< ref "/nginx-one/nap-integration/add-signature-sets.md/" >}})
50+
51+
5. Click **Add Cookie** to save your configuration

‎content/nginx-one/nap-integration/add-parameters.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Managing Parameters in NAP Policy
2+
Parameters can be configured and managed directly within the policy editor by selecting the **Parameters** option.
3+
4+
## Parameter Properties and Types
5+
Each parameter configuration includes:
6+
- `Parameter Type`: `Explicit` or `Wildcard`. For details on explicit and wildcard matching, see the [Matching Types: Explicit vs Wildcard]({{< ref "/nginx-one/nap-policy-matching-types.md" >}}) section.
7+
- `Name`: The name of the parameter
8+
- `Location`: Where the parameter is expected (URL query string, POST data, etc.)
9+
- `Value Type`: The expected type of the parameter value (e.g., alpha-numeric, integer, email)
10+
- `Attack Signatures`: Whether attack signature checking is enabled for this parameter
11+
- `Mask Value in Logs`: When enabled, the parameter's value will be masked in the request log for enhanced security and privacy
12+
13+
14+
For a complete list of configurable cookie properties and options, see the [Parameter Configuration Parameters]({{< ref "/waf/policies/parameter-reference.md" >}}) documentation under the `parameters` section.
15+
16+
## Parameter Violations
17+
Click on **Edit Configuration** to configure parameter violations. The following violations can be configured for parameters:
18+
19+
- `VIOL_PARAMETER`: Triggered when an illegal parameter is detected
20+
- `VIOL_PARAMETER_ARRAY_VALUE`: Triggered when an array parameter value is illegal
21+
- `VIOL_PARAMETER_DATA_TYPE`: Triggered when parameter data type doesn't match configuration
22+
- `VIOL_PARAMETER_EMPTY_VALUE`: Triggered when a parameter value is empty but shouldn't be
23+
- `VIOL_PARAMETER_LOCATION`: Triggered when a parameter is found in wrong location
24+
- `VIOL_PARAMETER_NAME_METACHAR`: Triggered when illegal meta characters are found in parameter name
25+
- `VIOL_PARAMETER_NUMERIC_VALUE`: Triggered when numeric parameter value is outside allowed range
26+
- `VIOL_PARAMETER_REPEATED`: Triggered when a parameter name is repeated illegally
27+
- `VIOL_PARAMETER_STATIC_VALUE`: Triggered when a static parameter value doesn't match configuration
28+
- `VIOL_PARAMETER_VALUE_LENGTH`: Triggered when parameter value length exceeds limits
29+
- `VIOL_PARAMETER_VALUE_METACHAR`: Triggered when illegal meta characters are found in parameter value
30+
- `VIOL_PARAMETER_VALUE_REGEXP`: Triggered when parameter value doesn't match required pattern
31+
32+
For each violation type, you can:
33+
- Set the enforcement action
34+
- Toggle `alarm` and `block` settings
35+
36+
For more details about enforcement modes, see the [Glossary]({{< ref "/nginx-one/glossary.md#nginx-app-protect-waf-terminology" >}}), specifically the entry: **Enforcement mode**.
37+
38+
# Adding a Parameter to Your Policy
39+
40+
1. Choose Parameter Type:
41+
- Select either `Explicit` for exact parameter matching or `Wildcard` for pattern-based matching
42+
43+
2. Configure Basic Properties:
44+
- Enter the parameter `Name`
45+
- Select the `Location` where the parameter is expected
46+
- Choose the `Value Type` (alpha-numeric, integer, email, etc.)
47+
- Set the `Data Type` if applicable
48+
49+
3. Set Security Options:
50+
- Choose whether to enable attack signatures
51+
- Decide if parameter value should be masked in logs which sets `sensitiveParameter` in [Parameter Configuration Reference]({{< ref "/waf/policies/parameter-reference.md" >}})
52+
53+
4. Optional: Configure Attack Signatures
54+
- If enabled, you can overwrite attack signatures for this specific parameter
55+
- For details on signature configuration, refer to the documentation on [Add Signature Sets]({{< ref "/nginx-one/nap-integration/add-signature-sets.md/" >}})
56+
57+
5. Click **Add Parameter** to save your configuration

‎content/nginx-one/nap-integration/signature-sets.md‎ renamed to ‎content/nginx-one/nap-integration/add-signature-sets.md‎

File renamed without changes.

‎content/nginx-one/nap-integration/add-urls.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Managing URLs in NAP Policy
2+
URLs can be configured and managed directly within the policy editor by selecting the **URLs** option.
3+
4+
## URL Properties and Types
5+
Each URL configuration includes:
6+
- `URL Type`: `Explicit` or `Wildcard`. For details on explicit and wildcard matching, see the [Matching Types: Explicit vs Wildcard]({{< ref "/nginx-one/nap-policy-matching-types.md" >}}) section
7+
- `Method`: Specifies which HTTP methods are allowed (`GET`, `POST`, `PUT`, etc.)
8+
- `Protocol`: The protocol for the URL (`HTTP`/`HTTPS`)
9+
- `Enforcement Type`:
10+
- **Allow**: Permits access to the URL with optional attack signature checks
11+
- **Disallow**: Blocks access to the URL entirely
12+
- `Attack Signatures`: Indicates whether attack signatures and threat campaigns are enabled, disabled, or not applicable
13+
14+
**⚠️ Important:** Attack Signatures are automatically set to "Not Applicable" when Enforcement Type is set to `Disallow` since the URL is explicitly blocked and signature checking is unnecessary.
15+
16+
For a complete list of configurable URL properties and options, see the [URL Configuration Parameters]({{< ref "/waf/policies/parameter-reference.md" >}}) documentation under the `urls` section.
17+
18+
## URL Violations
19+
Click on **Edit Configuration** to configure URL violations. The following violations can be configured for URLs:
20+
21+
- `VIOL_URL`: Triggered when an illegal URL is accessed
22+
- `VIOL_URL_CONTENT_TYPE`: Triggered when there's an illegal request content type
23+
- `VIOL_URL_LENGTH`: Triggered when URL length exceeds the configured limit
24+
- `VIOL_URL_METACHAR`: Triggered when illegal meta characters are found in the URL
25+
26+
For each violation type, you can:
27+
- Set the enforcement action
28+
- Toggle `alarm` and `block` settings
29+
30+
For more details about enforcement modes, see the [Glossary]({{< ref "/nginx-one/glossary.md#nginx-app-protect-waf-terminology" >}}), specifically the entry: **Enforcement mode**.
31+
32+
# Adding a URL to Your Policy
33+
34+
1. Choose URL Type:
35+
- Select either `Explicit` for exact URL matching or `Wildcard` for pattern-based matching
36+
37+
2. Configure Basic Properties:
38+
- Enter the `URL` path
39+
- Select allowed `Method(s)` (e.g., `GET`, `POST`, *)
40+
- Choose the `Protocol` (`HTTP`/`HTTPS`)
41+
42+
3. Set Enforcement:
43+
- Choose whether to allow or disallow the URL
44+
- If `Allow URL` is selected, you can optionally enable attack signatures
45+
46+
**⚠️ Important:** Attack signatures cannot be enabled for disallowed URLs.
47+
48+
4. **Optional**: Configure Attack Signatures
49+
- If enabled, you can overwrite attack signatures for this specific URL
50+
- For details on signature configuration, refer to the documentation on [Add Signature Sets]({{< ref "/nginx-one/nap-integration/add-signature-sets.md/" >}})
51+
52+
5. Click **Add URL** to save your configuration

‎content/nginx-one/nap-integration/advanced-configurations.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Advanced Configuration for NAP Policies
2+
3+
This document consolidates advanced configuration options for parameters, URLs, and cookies in NGINX App Protect (NAP) policies. These configurations allow for fine-tuning security settings to meet specific application requirements. By centralizing these options, this guide provides a unified reference for creating granular and robust security policies.
4+
5+
## Shared Advanced Configuration Options
6+
7+
The following advanced configuration options are common to parameters, URLs, and cookies:
8+
9+
- **Length Restrictions**: Define maximum allowable lengths to prevent excessively long inputs that could indicate malicious activity.
10+
- **Meta Character Overrides**: Specify allowed or disallowed meta characters to ensure compliance with application-specific requirements.
11+
- **Custom Signature Sets**: Apply custom signature sets to tailor attack detection mechanisms for specific use cases.
12+
13+
## Parameter-Specific Configuration Options
14+
15+
In addition to the shared options, parameters support the following advanced configurations:
16+
17+
- **Regular Expression Patterns**: Use regex patterns to validate parameter values against expected formats, enhancing security and reducing false positives.
18+
- **Static Value Constraints**: Set fixed values for parameters to enforce strict compliance with predefined rules.
19+
- **Numeric Value Ranges**: Define acceptable numeric ranges for parameters to prevent out-of-bound values.
20+
21+
## URL-Specific Configuration Options
22+
23+
In addition to the shared options, URLs support the following advanced configurations:
24+
25+
- **Content Type Profiles**: Configure content type profiles (e.g., JSON, XML, form-data) to validate request payloads.
26+
27+
## Cookie-Specific Configuration Options
28+
29+
In addition to the shared options, cookies support the following advanced configurations:
30+
31+
- **Mask Value in Logs**: Enable masking of cookie values in logs for enhanced security and privacy.
32+
33+
These configurations help create a more granular and specific security policy for your application. For detailed instructions on implementing these options, refer to the [Policy Parameter Reference]({{< ref "/waf/policies/parameter-reference.md" >}}).

0 commit comments

Comments
 (0)