0

I'm working on securing an application that receives SQL and HTML-like information that is actually proprietry formulas in some cases, and parts of XML documents in other cases.

So the WAF thinks some HTTP requests are SQL or HTML injection attacks while they actually aren't.

So how can I send these formulas and XML informaiton without triggering those WAF rules? I tried encoding the data but that didn't work.

Improve this question
3
  • 2
    Had you looked at the exceptions configuration settings for the WAF? I believe there's an exception list on the major WAF products out there.
    – ThoriumBR
    Aug 11, 2020 at 1:16
  • 2
    False positives are one of the downsides of WAFs. If yours doesn't have configuration options that work for you, you may have to ditch it or find another
    – Conor Mancone
    Aug 11, 2020 at 2:19
  • The answer will depend on the type of WAF you have and how it is configured.
    – schroeder ♦
    Aug 11, 2020 at 7:25

1 Answer 1

Reset to default
2

So how can I send these formulas and XML informaiton without triggering those WAF rules? I tried encoding the data but that didn't work.

A WAF is there to protect an application. The application should not need to work around the WAF but the WAF should be tuned to match the expected behavior of the application. This is no different from other firewalls or IDS, which need to be tuned to the expected traffic.

Of course, the application has to make sure that these requests are really innocent even if they might look like SQL or HTML injection to some (dumb?) WAF rule.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .