Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a external user getting a weird error in the middle of using my website. The user authenticates, post a search for information, and then with the address of the search results page they get a Request denied by WatchGuard Firewall page with the Reason: IPS detected for "WEB long basic authorization string/Buffer Over Flow".

It doesn't make sense to be that there would be an authorization string difference between the time they are visiting the search page and the time they are receiving the search results page.

Have anyone seen this pattern of error?

share|improve this question

1 Answer

up vote 2 down vote accepted

This is all of the hallmark of a false positive. Are you even using HTTP basic auth to access this website? My guess is that your web application firewall is overpriced and poorly made. You should try mod_security, its free and also poorly made.

share|improve this answer
This particular site is indeed using basic auth, but looking closer at it showed that they were getting the error when accessing it via their proxy server which seemed to switch from https to http mid session. I am not sure of the fix on their end, but that appears to have been the issue. Thanks for taking a look. – Dennis Allen May 21 '12 at 16:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.