Creating JSON protection rules
JSON protection rules define and enforce acceptable JSON content, including:
- Limits for data size, key, and value, etc.
- Preventing forbidden JSON from making requests
FortiWeb responds to rule violations of JSON protection rules according to the response action specified in a rule that a request has violated. Multiple JSON protection rules can be organized into policies that FortiWeb enforces. You can create up to 256 rules per policy.
This section provides instructions to:
- Create a JSON protection rule
- Add a JSON protection rule to a JSON protection policy
To create a JSON protection rule
- Go to JSON > JSON Protection Rule.
- Click Create New.
- Configure these settings:
- Simple String—The field is a string that the request URL must match exactly.
- Regular Expression—The field is a regular expression that defines a set of matching URLs.
-
Simple String—The literal URL, such as
/index.php, that the HTTP request must contain in order to match the rule. The URL must begin with a slash (/). -
Regular Expression—A regular expression, such as
^/*.php, matching the URLs to which the rule should apply. The pattern does not require a slash (/), but it must match URLs that begin with a slash, such as/index.cfm. - Alert—Accept the connection and generate an alert email and/or log message.
-
Alert & Deny—Block the request (or reset the connection) and generate an alert and /or log message.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see Customizing error and authentication pages (replacement messages).
- Deny (no log)—Block the request (or reset the connection).
-
Period Block—Block subsequent requests from the client for a number of seconds. Also configure Block Period.
You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see Customizing error and authentication pages (replacement messages).
Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you must also define an X-header that indicates the original client’s IP. Failure to do so may cause FortiWeb to block all connections when it detects a violation of this type. For details, see Defining your proxies, clients, & X-headers.
- Redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert and/or log message. Also configure Redirect URL and Redirect URL With Reason.
-
Send 403 Forbidden—Reply with an HTTP
403 Access Forbiddenerror message and generate an alert and/or log message. - Low
- Medium
- High
- Informative
- Click OK.
|
Name |
Enter a name that can be referenced by other parts of the configuration. You will use the name to select the rule in a JSON protection policy. The maximum length is 63 characters. |
||
|
Host status |
Enable to compare the JSON rule to the |
||
|
Select the IP address or FQDN of a protected host. For details, see Defining your protected/allowed HTTP “Host:” header names. |
|||
|
Select whether the Request URL field must contain either: |
|||
|
Depending on your selection in Request URL type, enter either: Do not include the domain name, such as To test a regular expression, click the >> (test) icon. This icon opens the Regular Expression Validator window from which you can fine-tune the expression. For details, see Regular expression syntax and Cookbook regular expressions. |
|||
|
JSON Limits |
Enable to define limits for data size, key, and value, etc. |
||
|
Enter the total size of JSON data in the JSON file. The valid range is 0–10240. The default value is 1024. |
||
|
Enter the key size of each object. The valid range is 0–10240. The default value is 64. |
||
|
Enter the total key number of each JSON file. The valid range is 0–2147483647. The default value is 256. |
||
|
Enter the value size of each key. The valid range is 0–10240. The default value is 128. |
||
|
Enter the total value number of each JSON file. The valid range is 0–2147483647. The default value is 256. |
||
|
Enter the total value number in an array. The valid range is 0–2147483647. The default value is 256. |
||
|
Enter the number of the nested objects. The valid range is 0–2147483647. The default value is 32. |
||
|
Schema Validation |
Optionally, select a JSON schema file. For details, see Importing JSON schema files. |
||
|
Select which action FortiWeb will take when it detects a violation of the rule: The default value is Alert. See also Reducing false positives. Note: Logging will occur only if enabled and configured. For details, see Logging and Alert email. |
|||
|
Enter the amount of time (in seconds) that you want to block subsequent requests from a client after FortiWeb detects a rule violation. This setting is available only when Action is set to Period Block. The valid range is 1–3,600. The default value is 60. For details about tracking blocked clients, see Monitoring currently blocked IPs. |
|||
|
Severity |
When FortiWeb records rule violations in the attack log, each log message contains a Severity Level field. Select the severity level that FortiWeb will record when the rule is vioated: The default value is Low. |
||
|
Trigger Policy |
Select the trigger, if any, that FortiWeb carries out when it logs and/or sends an alert email about a rule violation. For details, see Viewing log messages. |
To add a JSON protection rule to a JSON protection policy
For details about creating a JSON protection policy, see Creating JSON protection policy.
- Go to JSON Protection > JSON Protection Policy.
- Select the existing JSON protection policy to which you want to add the JSON protection rule.
- Click Edit.
- Click Create New.
- For Rule, select the JSON protection rule that you want to include in the JSON protection policy.
Note: To view details about a selected JSON protection rule, click the view icon next to the drop down list.
- Click OK.
- Repeat Steps 4-6 for as many JSON protection rules as you want to add to the JSON protection policy.