Configuring XML protection
XML is commonly used for data exchange, and hackers sometimes try to exploit security holes in XML code to attack web servers. You can configure FortiWeb to examine client requests for anomalies in XML code. FortiWeb can also attempt to validate the structure of XML code in client requests using trusted XML schema files. Configuring XML protection can help to ensure that the content of requests containing XML does not contain any potential attacks.
XML protection is available in Reverse Proxy, True Transparent Proxy, and WCCP operating modes.
This section consists of instructions for the following steps:
- Importing XML schema files. For details, see Importing XML schema files.
- Creating XML protection rules. For details, see Creating XML protection rules.
- Creating XML protection policies. For details, see Creating XML protection policies.
- Creating WSDL files. For details, see Importing WSDL files
- Configuring exempted URLs. For details, see Configuring exempted URLs.
- Creating WS-Security rules. For details, see Creating WS-Security rules.
- Selecting an XML protection policy in a web protection profile. For details, see To select an XML protection policy in a web protection profile.
- Configuring attack logs to retain packet payloads for XML protection. For details, see Configuring attack logs to retain packet payloads for XML protection.
To configure XML protection, you must have Read and Write permission to items in the Web Protection Configuration category. For details, see Permissions.