Protection Configuration Overview

WAF engines will check user requests and responses returned by the origin server in a certain sequence and anonymize WAF logs according to the configurations.

Figure 1 shows the WAF engine work process and the sequence of rules in each detection phase.

Figure 1 WAF engine work process

The detection process is as follows:

1. Parsing phase: WAF parses the original HTTP or HTTPS request packets from the client to obtain the request header, request line, and request body, and determines the forwarding policy based on the request packets.
2. Detection phase:
   1. WAF obtains the protection rules you configure based on the request information it identifies.
   2. WAF parses the request content, such as the source IP address, domain name, and request length.
   3. WAF checks the request content based on configured protection rules in sequence shown in Figure 1. If the request matches the conditions configured in a protection rule, WAF handles the request based on the protective action configured in the rule.
3. Response detection phase:
   1. WAF parses the server response.
   2. WAF checks the response based on configured protection rules in the sequence shown in Figure 1. If the response matches the conditions configured in a protection rule, WAF handles the response based on the protective action configured in the rule.
4. Log recording phase: WAF processes WAF logs based on configured data masking rules to prevent sensitive information such as user accounts and passwords from being displayed in logs.

Protective actions are a series of measures taken by WAF when detecting that a request matches the filter criteria configured in a protection rule. Only one protective action can be configured for protection rules with the same conditions.

WAF supports the following protective actions:

• Log only

  If WAF detects that a request matches the conditions configured in a protection rule, it does not take any action but records the activity for subsequent analysis and review by the security team.

  After a website is connected to WAF, by default, WAF will enable General Check under Basic Web Protection and Scanner under Anti-Crawler, and set their Protective Action to Log only. If you are not sure about your service traffic characteristics, you can keep the Log only action for a while, observe the traffic, analyze attack logs, and then configure targeted protection rules.

• Block

  If WAF detects that a request matches the conditions configured in a protection rule, WAF blocks the request and stops checking the request based on the subsequent rules.

  If the protective action is set to Block, you can configure a known attack source rule to block the IP addresses, cookies, or parameters of the visitor for a long or short period. In this way, WAF automatically blocks requests from the visitor. For details, see Configuring a Known Attack Source Rule to Block Specific Visitors for a Specified Duration.

  

  If your service scenarios are complex and require multiple types of protection rules, you need to comprehensively analyze all protection rules used for your services and make sure all these rules can work as expected. This is because the Block action in the current rule may stop WAF from checking the requests based on other rules with lower priorities than the current rule. To obtain a configuration example, see Protection Rule Examples.

• Allow
  If WAF detects that a request matches the conditions configured in a protection rule, WAF allows the request and stops checking the request based on the subsequent rules.

  

  If your service scenarios are complex and require multiple types of protection rules, you need to comprehensively analyze all protection rules used for your services and make sure all these rules can work as expected. This is because the Allow action in the current rule may stop WAF from checking the requests based on other rules with lower priorities than the current rule. Subsequent rules become invalid. For details about the configuration example, see Protection Rule Examples.

• JS Challenge

  If WAF detects a request that matches the conditions configured in a protection rule, WAF returns a piece of JavaScript code that can be automatically executed by a normal browser to the client. If the client properly executes the JavaScript code, WAF allows all requests from the client within the validity period of the token. During this period, no verification is required. If the client fails to execute the code, WAF blocks the requests.

• Block dynamically

  In a CC attack protection rule, if the number of access requests exceeds the rate limit in a rate limiting period, WAF blocks the requests. In the next rate limiting period, WAF blocks the requests according to the allowable frequency.

  For example, we set Rate limit to 10 requests within every 60 seconds and Allowance Frequency to 5 requests within every 60 seconds. If the number of requests exceeds 10 in the first 60 seconds, WAF blocks the access. In the second 60 seconds, WAF blocks the access when the number of requests exceeds 5.

• Verification code

  In a CC attack protection rule, if the number of requests exceeds the rate limit, WAF displays a verification code for human-machine verification. The access will be restricted unless the verification is successful. If the verification fails, the system restricts the access based on Block Duration configured in the rule.