waf websocket-security rule

Use this command to configure WebSocket rule related settings.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf websocket-security rule

edit websocket-security_rule_name

set host-status {enable | disable}

set host <host_str>

set url-type {plain | regular}

set url <url_str>

set block-websocket-traffic {enable | disable}

set action {alert | deny_no_log | alert_deny}

set max-frame-size <max-frame-size_int>

set max-message-size <max-message-size_int>

set block-extensions {enable | disable}

set enable-attack-signatures {enable | disable}

set allow-plain-text {enable | disable}

set allow-binary-text {enable | disable}

config allowed-origin-list

edit allowed-origin-list <allowed-origin-list_id>

set origin <origin_str>

next

end

next

end

Variable	Description	Default
websocket-security_rule_name	Enter the WebSocket security rule name.	No default.
host-status {enable | disable}	Enable to compare the WebSocket security rule to the Host: field in the HTTP header.	No default.
host <host_str>	Select the IP address or fully qualified domain name (FQDN) of the protected host to which this rule applies. This option is available only if Host Status is enabled.	No default.
url-type {plain | regular}	Select whether the URL Pattern field will contain a literal URL (Simple String), or a regular expression designed to match multiple URLs (Regular Expression).	Plain
url <url_str>	The URL which hosts the web page containing the user input fields you want to protect.	No default.
block-websocket-traffic {enable | disable}	Enable to deny the WebSocket traffic, and FortiWeb will not check any WebSocket related traffic. This option is disabled by default.	Disable
action {alert | deny_no_log | alert_deny}	Select which action the FortiWeb appliance will take when it detects a violation. Alert—Accept the connection and generate an alert email and/or log message. Alert & Deny—Block the request (or reset the connection) and generate an alert and/or log message. Deny (no log)—Block the request (or reset the connection).	Alert
max-frame-size <max-frame-size_int>	Specifies the maximum acceptable frame header and body size in bytes. The valid range is 0–2147483647 bytes.	64
max-message-size <max-message-size_int>	Specifies the maximum acceptable message header and body size in bytes. The valid range is 0–2147483647 bytes.	1024
block-extensions {enable | disable}	Enable to not check the extension header in WebSocket handshake packet. By default, this option is disabled.	Disable
enable-attack-signatures {enable | disable}	Enable to detect attack in WebSocket message body. But if WebSocket traffic has extension header and allow extension header in WebSocket security rule, FortiWeb can not detect attack signatures. When attack signature is detected, the actions FortiWeb will take follow those of related signatures.	Disable
allow-plain-text {enable | disable}	Enable to allow detecting the plain text.	Enable
allow-binary-text {enable | disable}	Enable to allow detecting the binary text.	Enable
allowed-origin-list <allowed-origin-list_id>	Enter the origin list ID in WebSocket handshake packet.	No default.
origin <origin_str>	Enter the allowed origin.	No default.

Related topics

• waf http-constraints-exceptions
• waf http-protocol-parameter-restriction