waf websocket-security rule
Use this command to configure WebSocket rule related settings.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.
Syntax
config waf websocket-security rule
edit websocket-security_rule_name
set host-status {enable | disable}
set host <host_str>
set url-type {plain | regular}
set url <url_str>
set block-websocket-traffic {enable | disable}
set action {alert | deny_no_log | alert_deny}
set max-frame-size <max-frame-size_int>
set max-message-size <max-message-size_int>
set block-extensions {enable | disable}
set enable-attack-signatures {enable | disable}
set allow-plain-text {enable | disable}
set allow-binary-text {enable | disable}
config allowed-origin-list
edit allowed-origin-list <allowed-origin-list_id>
next
end
next
end
|
Variable |
Description |
Default |
|---|---|---|
| Enter the WebSocket security rule name. | No default. | |
Enable to compare the WebSocket security rule to the Host: field in the HTTP header. |
No default. | |
| Select the IP address or fully qualified domain name (FQDN) of the
protected host to which this rule applies. This option is available only if Host Status is enabled. |
No default. | |
| Select whether the URL Pattern field will contain a literal URL (Simple String), or a regular expression designed to match multiple URLs (Regular Expression). |
Plain
|
|
| The URL which hosts the web page containing the user input fields you want to protect. | No default. | |
| Enable to deny the WebSocket traffic, and FortiWeb will not check any WebSocket related traffic. This option is disabled by default. |
Disable
|
|
| Select which action the FortiWeb appliance will take when it detects a
violation. Alert—Accept the connection and generate an alert email and/or log message. Alert & Deny—Block the request (or reset the connection) and generate an alert and/or log message. Deny (no log)—Block the request (or reset the connection). |
Alert
|
|
| Specifies the maximum acceptable frame header and body size in bytes. The valid range is 0–2147483647 bytes. |
64
|
|
| Specifies the maximum acceptable message header and body size in bytes. The valid range is 0–2147483647 bytes. |
1024
|
|
| Enable to not check the extension header in WebSocket handshake packet. By default, this option is disabled. |
Disable
|
|
| Enable to detect attack in WebSocket message body. But if WebSocket traffic has extension header and allow extension header in WebSocket security rule, FortiWeb can not detect attack signatures. When attack signature is detected, the actions FortiWeb will take follow those of related signatures. |
Disable
|
|
| Enable to allow detecting the plain text. |
Enable
|
|
| Enable to allow detecting the binary text. |
Enable
|
|
| Enter the origin list ID in WebSocket handshake packet. | No default. | |
| Enter the allowed origin. | No default. |