Help Center/ Web Application Firewall/ User Guide/ Configuring Protection Policies/ Configuring Web Tamper Protection Rules to Prevent Static Web Pages from Being Tampered With
Updated on 2024-11-01 GMT+08:00
View PDF

Configuring Web Tamper Protection Rules to Prevent Static Web Pages from Being Tampered With

You can set web tamper protection rules to protect specific website pages (such as the ones contain important content) from being tampered with. If a web page protected with such a rule is requested, WAF returns the origin page it has cached based on the rule so that visitors always receive the authenticate web pages.

If you have enabled enterprise projects, ensure that you have all operation permissions for the project where your WAF instance locates. Then, you can select the project from the Enterprise Project drop-down list and configure protection policies for the domain names in the project.

How It Works

  • Return directly the cached web page to the normal web visitor to accelerate request response.
  • Return the cached original web pages to visitors if an attacker has tampered with the static web pages. This ensures that your website visitors always get the right web pages.
  • Protect all resources in the web page path. For example, if a web tamper protection rule is configured for a static page pointed to www.example.com/index.html, WAF protects the web page pointed to /index.html and related resources associated with the web page.

    So, if the URL in the Referer header field is the same as the configured anti-tamper path, for example, /index.html, all resources (resources ending with png, jpg, jpeg, gif, bmp, css or js) matching the request are also cached.

Prerequisites

You have added your website to a policy.

Constraints

  • It takes several minutes for a new rule to take effect. After the rule takes effect, protection events triggered by the rule will be displayed on the Events page.
  • Ensure that the origin server response contains the Content-Type response header, or WAF may fail to cache the origin server response.

Application Scenarios

  • Quicker response to requests

    After a web tamper protection rule is configured, WAF caches static web pages on the server. When receiving a request from a web visitor, WAF directly returns the cached web page to the web visitor.

  • Web tamper protection

    If an attacker modifies a static web page on the server, WAF still returns the cached original web page to visitors. Visitors never see the pages that were tampered with.

    WAF randomly extracts requests from a visitor to compare the page they received with the page on the server. If WAF detects that the page has been tampered with, it notifies you by SMS or email, depending on what you configure. For more details, see Enabling Alarm Notifications.

Configuring a Web Tamper Protection Rule

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. Click in the upper left corner of the page and choose Security > Web Application Firewall.
  4. In the navigation pane on the left, choose Policies.
  5. Click the name of the target policy to go to the protection configuration page.
  6. Click the Web Tamper Protection configuration area and toggle it on or off if needed.

    • : enabled.
    • : disabled.

  7. In the upper left corner above the Web Tamper Protection rule list, click Add Rule.
  8. In the displayed dialog box, specify the parameters by referring to Table 1.

    Figure 1 Adding a web tamper protection rule
    Table 1 Rule parameters

    Parameter

    Description

    Example Value

    Domain Name

    Domain name of the website to be protected

    www.example.com

    Path

    A part of the URL, not including the domain name

    A URL is used to define the address of a web page. The basic URL format is as follows:

    Protocol name://Domain name or IP address[:Port]/[Path/.../File name].

    For example, if the URL is http://www.example.com/admin, set Path to /admin.

    NOTE:
    • The path does not support regular expressions.
    • The path cannot contain two or more consecutive slashes. For example, ///admin. If you enter ///admin, WAF converts /// to /.

    /admin

    Rule Description

    A brief description of the rule. This parameter is optional.

    None

  9. Click Confirm. You can view the rule in the list of web tamper protection rules.

Related Operations

  • To disable a rule, click Disable in the Operation column of the rule. The default Rule Status is Enabled.
  • To update cache of a protected web page, click Update Cache in the row containing the corresponding web tamper protection rule. If the rule fails to be updated, WAF will return the recently cached page but not the latest page.
  • To delete a rule, click Delete in the row containing the rule.

Configuration Example - Static Web Page Tamper Prevention

To verify WAF is protecting a static page /admin on your website www.example.com from being tampered with:

  1. Add a web tamper prevention rule to WAF.

    Figure 2 Adding a web tamper protection rule

  2. Enable WTP.

    Figure 3 Web Tamper Protection configuration area

  3. Simulate the attack to tamper with the http://www.example.com/admin web page.
  4. Use a browser to access http://www.example.com/admin. WAF will cache the page.
  5. Access http://www.example.com/admin again.

    The intact page is returned.