format-checks — enable

set xss-checks — enable

set sql-injection-checks — enable

severity —high

action — deny

format-checks — enable

set xss-checks — enable

set sql-injection-checks — enable

severity — medium

action — alert

Enable or disable JSON format checks, which are security checks for incoming HTTP requests to determine whether they are well-formed.

Note: If enabled, you must specify FortiADC response actions to malformed HTTP requests, as discussed below.

Enable or disable parsing limits to protect web servers from attacks, such as DDOS attacks.

Note: If enabled, you must change the configuration for the following parameters:

• Limit max array value
• Limit max depth
• Limit max object member
• Limit max string

Specify the maximum value within a single array. The default value is 256. Valid values range from 0 to 4,096.

Note: This option is available only when JSON limit-checks is enabled.

Specify the maximum depth in a JSON value. The default value is 16. Valid values range from 0 to 4,096.

Note: This option is available only when JSON limit-checks is enabled.

Specify the maximum number of members in a JSON object. The default value is 64. Valid values range from 0 fro 4,096.

Note: This option is available only when JSON limit-checks is enabled.

Specify the maximum length of a string in a JSON request for a name or a value. The default value is 64. Valid values range from 0 to 4,096.

Note: This option is available only when JSON limit-checks is enabled.

Enable to examine the bodies of incoming JSON requests that might indicate possible cross-site scripting attacks.

Note: If the request contains a positive match, FortiADC will respond with the specified action, as discussed at the end of this table.

Enable to examine the bodies of incoming requests for inappropriate SQL characters and keywords, which may indicate an SQL injection attack.

Note: If the request contains a positive match, FortiADC will respond with the specified action, as discussed at the beginning of this table.

Set the severity level in WAF logs for potential attacks detected by the JSON detection profile by selecting one of the following:

• High
• Medium
• Low

Specify the action that FortiADC will take upon detecting a potential attack:

You can choose a WAF action object.

Enable or disable JSON schema validation detection.

Note:Before enabling JSON schema checks, you must upload a JSON schema file to check whether JSON content is well-formed.