"<inline-protection-profile_name>"

Enter the name of the inline protection profile. The maximum length is 63 characters.

To display the list of existing profiles, enter:

edit ?

http-session-management {enable | disable}

Enable to add an implementation of HTTP sessions, and track their states, using a cookie such as cookiesession1. Also configure http-session-timeout <seconds_int>.

Although HTTP has no inherent support for sessions, a notion of individual HTTP client sessions, rather than simply the source IP address and/or timestamp, is required by some features.

For example, you might want to require that a client’s first HTTP request always be a login page: the rest of the web pages should be inaccessible if they have not authenticated. Out-of-order requests could represent an attempt to bypass the web application’s native authentication mechanism. How can FortiWeb know if a request is the client’s first HTTP request?

If FortiWeb were to treat each request independently, without knowledge of anything previous, it could not, by definition, enforce page order.

Therefore FortiWeb must keep some record of the first request from that client (the session initiation). It also must record their previous HTTP request(s), until a span of time (the session timeout) has elapsed during which there were no more subsequent requests, after which it would require that the session be initiated again.

The session management feature provides such FortiWeb session support.

This feature requires that the client support cookies.

Note: You must enable this option:

• To enforce the start page rule, page access rule, and hidden fields rule, if any of those are selected.
• If you want to include this profile’s traffic in the traffic log, in addition to enabling traffic logs in general. For details, see log attack-log.

http-session-timeout <seconds_int>

Enter the HTTP session timeout in seconds. The valid range is 20–3,600.

This setting is available only if http-session-management {enable | disable} is enabled.

x-forwarded-for-rule "<x-forwarded-for_name>"

Specify the name of a rule that configures FortiWeb’s use of X-Forwarded-For: and X-Real-IP. The maximum length is 63 characters. For details, see waf x-forwarded-for.

To display the list of existing rules, enter:

set x-forwarded-for-rule ?

signature-rule {"High Level Security" | "Medium Level Security" | "Alert Only" | <signature-set_name>}

Specify a signature policy to include in the profile. The maximum length is 63 characters. For details, see waf signature.

To display the list of existing rules, enter:

set server-protection-rule ?

The type of attack that FortiWeb detects determines the attack log messages for this feature. For a list, see waf signature.

amf3-protocol-detection {enable | disable}

Enable to scan requests that use action message format 3.0 (AMF3) for these attacks if you have enabled those in the signature set specified by signature-rule {"High Level Security" | "Medium Level Security" | "Alert Only" | <signature-set_name>}:

• Cross-site scripting (XSS) attacks
• SQL injection attacks
• Common exploits

AMF3 is a binary format that Adobe Flash clients can use to send input to server-side software.

Caution: To scan for attacks or enforce input rules on AMF3, you must enable this option. Failure to enable the option will make the FortiWeb appliance unable to scan AMF3 requests for attacks.

json-validation-policy "<json-validation-policy_name>"

cors-protection-policy "<cors-protection-policy>"

mobile-app-identification {enable | disable}

Enable to configure the JWT token secret and token header to verify a request from a mobile application.

Refer to Approov doc for how to get the token.

token-secret <token-secret_str>

Enter the token secret that you have got from Approov.

Available only when mobile-app-identification {enable | disable} is enable.

token-header <token-header_str>

Specify the header where the token is carried.

Available only when mobile-app-identification {enable | disable} is enable.

mobile-api-protection <mobile-api-protection_name>

Select the name of an existing API protection policy. For details, see waf mobile-api-protection.

bot-mitigate-policy <bot-mitigate-policy_name>

Select the name of a bot mitigation policy. For details, see waf mobile-api-protection.

api-management-policy <api-management-policy_name>

Select the name of an API gateway policy. For details, see waf api-rules.

custom-access-policy "<combo-access_name>"

Select the name of a custom access policy. The maximum length is 63 characters. For details, see waf custom-access policy.

To display the list of existing policies, enter:

set custom-access-policy ?

padding-oracle "<rule_name>"

Select the name of a padding oracle protection rule. The maximum length is 63 characters. For details, see waf padding-oracle.

To display the list of existing rules, enter:

set padding-oracle ?

csrf-protection "<rule_name>"

cookie-security-policy "<cookie-security_name>"

Select the name of a cookie security policy. For details, see waf cookie-security.

To display the list of existing policies, enter:

set cookie-security-policy ?

parameter-validation-rule "<rule_name>"

Select the name of a parameter validation rule. The maximum length is 63 characters. For details, see waf parameter-validation-rule.

To display the list of existing rules, enter:

set parameter-validation-rule ?

hidden-fields-protection "<group_name>"

Select the name of a hidden field rule group that you want to apply, if any. The maximum length is 63 characters. For details, see waf hidden-fields-protection.

To display the list of existing groups, enter:

set hidden-fields-protection ?

file-upload-policy "<policy_name>"

Select the name of a file upload security policy to use, if any. The maximum length is 63 characters. For details, see server-policy custom-application application-policy.

To display the list of existing policies, enter:

set file-upload-policy ?

http-protocol-parameter-restriction "<constraint_name>"

Select the name of an HTTP protocol constraint that you want to apply, if any. The maximum length is 63 characters. For details, see waf http-protocol-parameter-restriction.

To display the list of existing profiles, enter:

set http-protocol-parameter-restriction ?

brute-force-login "<sensor_name>"

Select the name of a brute force login attack sensor. The maximum length is 63 characters. For details, see waf brute-force-login.

To display the list of existing sensors, enter:

set brute-force-login ?

url-access-policy "<policy_name>"

Select the name of a URL access policy. The maximum length is 63 characters. For details, see waf url-access url-access-policy.

To display the list of existing policies, enter:

set url-access-policy ?

page-access-rule "<rule_name>"

Select the name of a page order rule. The maximum length is 63 characters. For details, see waf page-access-rule.

To display the list of existing rule, enter:

set page-access-rule ?

start-pages "<rule_name>"

Select the name of a start page rule. The maximum length is 63 characters. For details, see waf start-pages.

To display the list of existing rules, enter:

set start-pages ?

This setting is available only if http-session-management {enable | disable} is enabled.

allow-method-policy "<policy_name>"

Select the name of an allowed method policy. The maximum length is 63 characters. For details, see server-policy custom-application application-policy.

To display the list of existing policies, enter:

set allow-method-policy ?

ip-list-policy "<policy_name>"

Select the name of a trusted IP or blacklisted IP policy. The maximum length is 63 characters. For details, see server-policy custom-application application-policy.

To display the list of existing policies, enter:

set ip-list-policy ?

geo-block-list-policy "<policy_name>"

Select the name of a geographically-based client IP black list that you want to apply, if any. The maximum length is 63 characters. For details, see waf geo-block-list.

To display the list of existing groups, enter:

set geo-block-list-policy ?

application-layer-dos-prevention "<policy_name>"

Select the name of an existing DoS protection policy to use with this profile, if any. The maximum length is 63 characters. For details, see waf application-layer-dos-prevention.

To display the list of existing profiles, enter:

set application-layer-dos-prevention ?

ip-intelligence {enable | disable}

Enable to apply intelligence about the reputation of the client’s source IP. Blocking and logging behavior is configured in waf ip-intelligence.

fortigate-quarantined-ips {enable | disable}

Enable to detect source IP addresses that a FortiGate unit is currently preventing from interacting with the network and protected systems.

To configure communication between the FortiOS and FortiWeb, see system fortigate-integration.

quarantined-ip-action {alert | alert_deny}

Specify the action that FortiWeb takes if it detects a quarantined IP address:

• alert—Accept the request and generate an alert email, log message, or both.
• alert_deny—Block the request and generate an alert, log message, or both.

quarantined-ip-severity {High | Medium | Low}

Specify the severity that FortiWeb assigns to quarantined IP log messages.

quarantined-ip-trigger "<trigger-policy_name>"

Select the name of the trigger to apply when FortiWeb detects a quarantined IP. For deails, see log trigger-policy.

To display the list of existing trigger policies, enter:

set trigger ?

known-search-engine {enable | disable}

Enable to allow or block predefined search engines, robots, spiders, and web crawlers according to your settings in the global list.

Enable to exempt popular search engines’ robots, spiders, and web crawlers from DoS sensors, brute force login sensors, HTTP protocol constraints, and combination rate & access control (called “advanced protection” and “custom policies” in the web UI).

This option improves access for search engines. Rapid access rates, unusual HTTP usage, and other characteristics that may be suspicious for web browsers are often normal with search engines. If you block them, your websites’ rankings and visibility may be affected.

By default, this option allows all popular predefined search engines. Known search engine indexer source IPs are updated via FortiGuard Security Service. To specify which search engines will be exempt, enable or disable each search engine in server-policy pattern custom-global-white-list-group.

Note: X-header-derived client source IPs do not support this feature in this release. If FortiWeb is deployed behind a load balancer or other web proxy that applies source NAT, this feature will not work. For details, see waf x-forwarded-for.

url-rewrite-policy "<group_name>"

Select the name of a URL rewriting rule set, if any, that will be applied to matching HTTP requests. The maximum length is 63 characters.

To display the list of existing policies, enter:

set url-rewrite-policy ?

For details, see waf url-access url-access-policy.

http-authen-policy "<policy_name>"

Select the name of an HTTP authentication policy, if any, that will be applied to matching HTTP requests. The maximum length is 63 characters. For details, see waf http-authen http-authen-policy.

To display the list of existing profiles, enter:

set http-authen-policy ?

If the HTTP client fails to authenticate, it will receive an HTTP 403 (Access Forbidden) error message.

http-header-security "<policy_name>"

Select the name of an HTTP Header Security Policy, if any. For details, see waf http-header-security.

To display the list of existing policies, enter:

set http-header-security ?

site-publisher-helper "<policy_name>"

Select the name of a site publishing policy, if any, that will be applied to matching HTTP requests. The maximum length is 63 characters. For details, see waf site-publish-helper policy.

To display the list of existing profiles, enter:

set site-publisher-policy ?

If the HTTP client fails to authenticate, it will receive an HTTP 403 (Access Forbidden) error message.

file-compress-rule "<rule_name>"

Select the name of an existing file compression rule to use with this profile, if any. The maximum length is 63 characters. For details, see waf file-compress-rule.

To display the list of existing rules, enter:

set file-compress-rule ?

web-cache-policy "<web-cache-policy_name>"

Select the name of content caching policy. The maximum length is 63 characters. For details, see waf web-cache-policy.

To display the list of existing policies, enter:

set web-cache-policy ?

user-tracking-policy "<user-tracking-policy_name>"

Select the name of a user tracking policy. The maximum length is 63 characters. For details, see waf user-tracking policy.

To display the list of existing policies, enter:

set user-tracking-policy ?

redirect-url "<redirect_fqdn>"

Enter a URL, including the FQDN/IP and path, if any, to which an HTTP client will be redirected if their HTTP request violates any of the rules in this profile.

For example, you could enter www.example.com/products/.

If you do not enter a URL, depending on the type of violation and the configuration, the FortiWeb appliance will log the violation, may attempt to remove the offending parts, and could either reset the connection or return an HTTP 403 (Access Forbidden) or 404 (File Not Found) error message.

The maximum length is 256 characters.

rdt-reason {enable | disable}

Enable to include the reason for URL redirection as a parameter in the URL, such as reason=DETECT_PARAM_RULE_FAILED, when traffic has been redirected using redirect-url "<redirect_fqdn>".

The FortiWeb appliance also adds fortiwaf=1 to the URL to detect and cancel a redirect loop when the redirect action recursively triggers an attack event.

Caution: If you specify a redirect URL that is protected by the FortiWeb appliance, you should enable this option to prevent infinite redirect loops.

data-analysis {enable | disable}

Enable this to collect data for servers covered by this profile. To view the statistics for collected data, in the web UI, go to Log&Report > Monitor > Data Analytics.

comment "<comment_str>"

Enter a description or other comment. If the comment contains more than one word or contains an apostrophe, surround the comment in double quotes ( " ). The maximum length is 199 characters.

device-tracking {enable | disable}

Enable Device Tracking. When this feature is enabled, if a device triggers a security violation, FortiWeb generates a unique device ID according to a set of the device's characteristics, including the time zone, source IP, operating system, browser, language, CPU, color depth, and screen size. For details, see system device-tracking.

device-reputation-security-policy "<drs_policy_name>"

Select the name of a device reputation security policy, if any. The maximum length is 63 characters. For details, see system device-tracking.

To display the list of existing policies, enter:

set device-reputation-security-policy ?

xml-validation-policy "<xml_policy_name>"

Select the name of an XML protection policy, if any. The maximum length is 63 characters. For details, see waf xml-validation.

To display the list of existing policies, enter:

set xml-validation-policy ?

profile-id "<profile-id_str>"

mitb-protection "<mitb-protection_name>"

openapi-validation-policy "<openapi-validation-policy_name>"