Restricting Malicious Requests in Promotions by Using Cookies and HWWAFSESID

Application Scenarios

• Scenario 1: To steal extra bonus (such as goods in promotions or downloads), a malicious actor may use the same account to send requests to a website by changing IP addresses or terminals.

  Protective measures: Using Cookies (or User IDs) to Configure a Path-based CC Attack Protection Rule

• Scenario 2: To steal extra bonus (such as goods in promotions or downloads), a malicious actor may use multiple accounts to send requests to a website through the same PC by frequently changing its IP address.

  Protective measures: Using HWWAFSESID to Configure a CC Attack Protection Rule

Using Cookies (or User IDs) to Configure a Path-based CC Attack Protection Rule

1. Log in to the management console and connect your website to WAF.
   • Cloud mode: Creating a Domain Name
   • Dedicated mode: Step 1: Add a Website to WAF (Dedicated Mode)

2. In the Policy column of the row containing the domain name, click the number to go to the Policies page.
3. In the CC Attack Protection configuration area, toggle CC Attack Protection on if needed. Then, click Customize Rule.
4. In the upper left corner of the CC Attack Protection page, click Add Rule.
5. Configure a CC attack protection rule using a cookie or user ID to limit traffic to the path. Figure 1 shows an example.
   Set the following parameters based on site requirements:

   Figure 1 Configuring service cookies
   

6. Click Confirm.

Using HWWAFSESID to Configure a CC Attack Protection Rule

1. Log in to the management console and connect your website to WAF.
   • Cloud mode: Creating a Domain Name
   • Dedicated mode: Step 1: Add a Website to WAF (Dedicated Mode)

2. In the Policy column of the row containing the domain name, click the number to go to the Policies page.
3. In the CC Attack Protection configuration area, toggle CC Attack Protection on () if needed. Then, click Customize Rule.
4. In the upper left corner of the CC Attack Protection page, click Add Rule.
5. Configure a CC attack protection rule using HWWAFSESID to limit traffic to the path. For details, see Figure 2.
   • User Identifier: Select Cookie and set it to HWWAFSESID.
   • Other parameters: Set them to meet your service requirements.
   Figure 2 HWWAFSESID-based rate limiting
   

6. Click Confirm.