Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

CLI Reference

waf csrf-protection

Use this command to protect against cross-site request forgery (CSRF). CSRF is an attack that exploits the trust that a site has in a user's browser to transmit unauthorized commands.

The CRSF protection feature is not supported when the operation mode is Offline Protection or Transparent Inspection.

To protect back-end servers from CSRF attacks, you create two lists of items: a list of web pages to protect against CSRF attacks, and a corresponding list of the URLs found in the requests that the pages generate. For more information on configuring CSRF protection, including troubleshooting and adding parameter filters, see the FortiWeb Administration Guide:

https://docs.fortinet.com/fortiweb/admin-guides

To apply a CSRF protection rule, you select it in an inline protection profile. For details, see waf web-protection-profile inline-protection.

Before you configure a CSRF protection rule, if you want to apply it only to HTTP requests for a specific real or virtual host, you must first define the web host in a protected hosts group. For details, see server-policy allow-hosts.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf csrf-protection

edit "<csrf-rule_name>"

set action {alert | alert_deny | block-period | deny_no_log}

set block-period <seconds_int>

set severity {High | Medium | Low | Info}

set trigger <trigger-policy_name>

config csrf-page-list

edit <entry_index>

set host <host_name>

set request-url <url_str>

set host-status {enable | disable}

set request-type {plain | regular}

set parameter-filter {enable | disable}

set parameter-name <parameter-name_str>

set parameter-value-type {plain | regular}

set parameter-value <parameter-value_str>

next

end

config csrf-url-list

edit <entry_index>

set host <host_name>

set request-url <url_str>

set host-status {enable | disable}

set request-type {plain | regular}

set parameter-filter {enable | disable}

set parameter-name <parameter-name_str>

set parameter-value-type {plain | regular}

set parameter-value <parameter-value_str>

next

end

next

end

Variable Description Default

"<csrf-rule_name>"

Enter the name of a new or existing rule. The maximum length is 63 characters.

To display the list of existing rules, enter:

edit ?

No default.

action {alert | alert_deny | block-period | deny_no_log}

Enter the action that FortiWeb takes when it detects a missing or incorrect anti-CSRF parameter:

  • alert—Accept the request and generate an alert email, a log message, or both.
  • alert_deny—Block the request (reset the connection) and generate an alert email, a log message, or both.

    You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg.
  • block-period—Block subsequent requests from the client for a number of seconds. Also configure block-period <seconds_int>.
  • deny_no_log—Deny a request. Do not generate a log message.

Note: Logging and alert email occur only if the corresponding settings are enabled and configured. For details, see log disk and log alertMail.

alert

block-period <seconds_int>

Enter the number of seconds that you want to block subsequent requests from the client after the FortiWeb appliance detects a CSRF attack.

The valid range is 1–3,600.

This setting applies only if action {alert | alert_deny | block-period | deny_no_log} is block-period.

60

severity {High | Medium | Low | Info}

Select the severity level to use in any logs and reports that FortiWeb generates when a violation of this rule occurs. Low

trigger <trigger-policy_name>

Enter the name of the trigger to apply when this rule is violated. For details, see log trigger-policy. The maximum length is 63 characters.

To display the list of existing trigger policies, enter:

set trigger ?

No default.

<entry_index>

Enter the index number of the individual entry in the table. No default.

host <host_name>

Enter a protected host name (either a web host name or IP address) that the Host: field of the HTTP request matches.

This setting applies only if host-status {enable | disable} is enable.

No default.

request-url <url_str>

Enter either a literal URL or regular expression, depending on the value of request-type. No default.

host-status {enable | disable}

Enter enableto apply this rule only to HTTP requests for specific web hosts. Also configure host.

Disable to match the rule based on the URL and any parameter filter only.

disable

request-type {plain | regular}

Select whether request-url <url_str> contains a literal URL (plain), or a regular expression designed to match multiple URLs (regular). plain

parameter-filter {enable | disable}

Enter enable to specify a parameter name and value to match.

The parameter can be located in either the URL or the HTTP body of a request.
disable

parameter-name <parameter-name_str>

Enter the name of the parameter name to match. No default.

parameter-value-type {plain | regular}

Select whether parameter-value <parameter-value_str> contains a literal value (plain) or a regular expression designed to match multiple parameters (regular). plain

parameter-value <parameter-value_str>

Enter either a literal parameter or regular expression, depending on the value of parameter-value-type {plain | regular}.

To match any parameter value, for parameter-value-type, enter regular, and for parameter-value, enter * (asterisk).
No default.

Example

The web page csrf_login.html contains the following HTML form:

<form name="do_some_action" id="form1" action="csrf_test2.php" method="GET">

<input type="text" name="username" value=""/>

<Input type="text" name="password" value=""/>

<input type="submit" value="do Action"/>

</form>

This form generates the following request when the page is added to the list of pages protected by a CSRF protection policy:

http://target-site.com/csrf_test2.php?username=test&password=123&tknfv=3DF5BDCCIG3DCXNTE3RUNCTKRS3E36AD

The CSRF protection feature adds the parameter tknfv with a value that matches the session ID.

To create this example, you add csrf_login.html to the list of pages and /csrf_check2.php to the list of URLs.

config waf csrf-protection

edit "csrf_rule1"

set action alert_deny

config csrf-page-list

edit 1

set request-url "csrf_login.html"

set request-type regular

next

end

config csrf-url-list

edit 1

set request-url "/csrf_check2.php"

set request-type plain

next

end

next

end

waf csrf-protection

Use this command to protect against cross-site request forgery (CSRF). CSRF is an attack that exploits the trust that a site has in a user's browser to transmit unauthorized commands.

The CRSF protection feature is not supported when the operation mode is Offline Protection or Transparent Inspection.

To protect back-end servers from CSRF attacks, you create two lists of items: a list of web pages to protect against CSRF attacks, and a corresponding list of the URLs found in the requests that the pages generate. For more information on configuring CSRF protection, including troubleshooting and adding parameter filters, see the FortiWeb Administration Guide:

https://docs.fortinet.com/fortiweb/admin-guides

To apply a CSRF protection rule, you select it in an inline protection profile. For details, see waf web-protection-profile inline-protection.

Before you configure a CSRF protection rule, if you want to apply it only to HTTP requests for a specific real or virtual host, you must first define the web host in a protected hosts group. For details, see server-policy allow-hosts.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf csrf-protection

edit "<csrf-rule_name>"

set action {alert | alert_deny | block-period | deny_no_log}

set block-period <seconds_int>

set severity {High | Medium | Low | Info}

set trigger <trigger-policy_name>

config csrf-page-list

edit <entry_index>

set host <host_name>

set request-url <url_str>

set host-status {enable | disable}

set request-type {plain | regular}

set parameter-filter {enable | disable}

set parameter-name <parameter-name_str>

set parameter-value-type {plain | regular}

set parameter-value <parameter-value_str>

next

end

config csrf-url-list

edit <entry_index>

set host <host_name>

set request-url <url_str>

set host-status {enable | disable}

set request-type {plain | regular}

set parameter-filter {enable | disable}

set parameter-name <parameter-name_str>

set parameter-value-type {plain | regular}

set parameter-value <parameter-value_str>

next

end

next

end

Variable Description Default

"<csrf-rule_name>"

Enter the name of a new or existing rule. The maximum length is 63 characters.

To display the list of existing rules, enter:

edit ?

No default.

action {alert | alert_deny | block-period | deny_no_log}

Enter the action that FortiWeb takes when it detects a missing or incorrect anti-CSRF parameter:

  • alert—Accept the request and generate an alert email, a log message, or both.
  • alert_deny—Block the request (reset the connection) and generate an alert email, a log message, or both.

    You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg.
  • block-period—Block subsequent requests from the client for a number of seconds. Also configure block-period <seconds_int>.
  • deny_no_log—Deny a request. Do not generate a log message.

Note: Logging and alert email occur only if the corresponding settings are enabled and configured. For details, see log disk and log alertMail.

alert

block-period <seconds_int>

Enter the number of seconds that you want to block subsequent requests from the client after the FortiWeb appliance detects a CSRF attack.

The valid range is 1–3,600.

This setting applies only if action {alert | alert_deny | block-period | deny_no_log} is block-period.

60

severity {High | Medium | Low | Info}

Select the severity level to use in any logs and reports that FortiWeb generates when a violation of this rule occurs. Low

trigger <trigger-policy_name>

Enter the name of the trigger to apply when this rule is violated. For details, see log trigger-policy. The maximum length is 63 characters.

To display the list of existing trigger policies, enter:

set trigger ?

No default.

<entry_index>

Enter the index number of the individual entry in the table. No default.

host <host_name>

Enter a protected host name (either a web host name or IP address) that the Host: field of the HTTP request matches.

This setting applies only if host-status {enable | disable} is enable.

No default.

request-url <url_str>

Enter either a literal URL or regular expression, depending on the value of request-type. No default.

host-status {enable | disable}

Enter enableto apply this rule only to HTTP requests for specific web hosts. Also configure host.

Disable to match the rule based on the URL and any parameter filter only.

disable

request-type {plain | regular}

Select whether request-url <url_str> contains a literal URL (plain), or a regular expression designed to match multiple URLs (regular). plain

parameter-filter {enable | disable}

Enter enable to specify a parameter name and value to match.

The parameter can be located in either the URL or the HTTP body of a request.
disable

parameter-name <parameter-name_str>

Enter the name of the parameter name to match. No default.

parameter-value-type {plain | regular}

Select whether parameter-value <parameter-value_str> contains a literal value (plain) or a regular expression designed to match multiple parameters (regular). plain

parameter-value <parameter-value_str>

Enter either a literal parameter or regular expression, depending on the value of parameter-value-type {plain | regular}.

To match any parameter value, for parameter-value-type, enter regular, and for parameter-value, enter * (asterisk).
No default.

Example

The web page csrf_login.html contains the following HTML form:

<form name="do_some_action" id="form1" action="csrf_test2.php" method="GET">

<input type="text" name="username" value=""/>

<Input type="text" name="password" value=""/>

<input type="submit" value="do Action"/>

</form>

This form generates the following request when the page is added to the list of pages protected by a CSRF protection policy:

http://target-site.com/csrf_test2.php?username=test&password=123&tknfv=3DF5BDCCIG3DCXNTE3RUNCTKRS3E36AD

The CSRF protection feature adds the parameter tknfv with a value that matches the session ID.

To create this example, you add csrf_login.html to the list of pages and /csrf_check2.php to the list of URLs.

config waf csrf-protection

edit "csrf_rule1"

set action alert_deny

config csrf-page-list

edit 1

set request-url "csrf_login.html"

set request-type regular

next

end

config csrf-url-list

edit 1

set request-url "/csrf_check2.php"

set request-type plain

next

end

next

end