Skip to main content
Version: 7.x

WAF Logics

Application Access Control Logic​

The WAF behavior is driven by application-specific rules. Each application can have multiple rules, and each rule consists of three main components: Identities, a Condition Profile, and an Action Profile.

The system evaluates the rules sequentially when a user attempts to access the application. It checks whether the requesting identity matches each rule and whether all defined conditions are satisfied. If both the identity and the conditions match, the rule is selected, and access is granted.

Once a matching rule that grants access is found, the system stops evaluating any further rules. If no rule matches, access is denied.

This same logic applies to HTTP/web applications. After a rule is selected and access is granted, the WAF behavior is determined by the Action Profile associated with that rule, which defines how requests are handled for the entire session. The selected Action Profile and its assigned HTTP Profiles remain in effect until the session ends.

WAF Evaluation Logic​

An Action Profile can contain multiple HTTP Profiles. Each HTTP Profile can contain multiple rules, and each rule can contain multiple conditions.

The evaluation logic is applied as follows:

  • OR logic between HTTP Profiles within an Action Profile
  • OR logic between rules within an HTTP Profile
  • AND logic between conditions within a rule

The administrator can define the enforcement mode inside the Actions profile:

  • Block: Blocks requests that match the HTTP Profile
  • Report: Logs matching requests without blocking them

Because HTTP Profiles inside an Action Profile use OR logic, a request matches the Action Profile if any associated HTTP Profile matches.

Example Use Case​

An admin wants to control user permission with the use of HTTP method sent to a web page within their HTTP application with these requirements:

  1. Block all DELETE on all URI.
  2. Allow PUT/POST on /login.html for all users.
  3. Block all other PUT/POST on other URI.
  4. Allow GET on all URI.

These requirements roughly translates to these WAF rules:

  • Rule 1: METHOD = DELETE
  • Rule 2: METHOD = PUT AND URI ≠ login
  • Rule 3: METHOD = POST AND URI ≠ login

Which results in the following logic:

BLOCK if
(METHOD = DELETE)
OR
(METHOD = PUT AND URI ≠ /login)
OR
(METHOD = POST AND URI ≠ /login)

Last updated on