waf user-tracking rule
Use this command to configure FortiWeb to track sessions by user and capture a username to reference in traffic and attack log messages.
When FortiWeb detects users that match the criteria that you specify in a user tracking policy, it stores the session ID and username.
To apply a user tracking rule, add it to a user tracking policy that you can select in an inline or Offline Protection profile. For details, see waf user-tracking policy.
You can apply a user tracking policy using either an inline or Offline Protection profile. However, Session Fixation Protection, Session Timeout, Limit Concurrent Users per Account, and Credential Stuffing Defense are not supported in Offline Protection mode.
You can also use the user tracking feature to create a filter in a custom rule that matches specific users. This type of custom rule requires you to create a user tracking policy and apply it to the protection profile that uses the custom rule. For details, see waf custom-access rule.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.
Syntax
edit "<rule_name>"
set hostname-ip "<hostname-ip_str>"
set host-status { enable | disable}
set authentication-url "<url_str>"
set username-parameter "<username_str>"
set password-parameter "<password_str>"
set session-id-name "<session-id_str>"
set logoff-path "<logoff_str>"
set session-fixation-protection {enable | disable}
set limit-users {enable | disable}
set maximum-users <maximum-users_int>
set session-idle-timeout <session-idle-timeout_int>
set session-timeout-enable {enable | disable}
set session-timeout-enforcement {enable | disable}
set session-timeout <timeout_int>
set session-frozen-time <frozen-time_int>
set session-frozen-action {alert | alert_deny | redirect | block-period | deny_no_log}
set session-frozen-block-period <block-period_int>
set session-frozen-severity {High | Medium | Low | Info}
set session-frozen-trigger "<trigger-policy_name>"
set default-action {failed | success}
set credential-stuffing-protection {enable | disable}
config match-condition
edit <entry_index>
set authentication-result-type {failed | success}
set HTTP-match-target {return-code | response-body | redirect-url}
set value-type {plain | regular}
next
end
next
end
| Variable | Description | Default |
|
Enter a name that identifies the rule. You will use this name to reference the rule in other parts of the configuration. The maximum length is 63 characters. |
No default. | |
|
Select which protected host names entry (either a web host name or
IP address) that the Available only when host-status { enable | disable} is enable. |
No default. | |
|
Enable to require that the Also configure hostname-ip "<hostname-ip_str>". |
disable
|
|
|
Enter the URL to match in authorization requests. Ensure that the value begins with a forward slash ( / ). |
No default. | |
|
Enter the username field value to match in authorization requests. |
No default. | |
|
Enter the password field value to match in authorization requests. |
No default. | |
|
Enter the name of the session ID that is used to identify each session. Examples of session ID names are |
No default. | |
|
Optionally, enter the URL of the request that a client sends to log out of the application. When the client sends this URL, FortiWeb stops tracking the user session. Ensure that the value begins with a forward slash ( / ). |
No default. | |
|
Enter FortiWeb erases the IDs for non-authenticated sessions only. For web applications that do not renew the session cookie when a user logs in, it is possible for an attacker to trick a user into authenticating with a session ID that the attacker acquired earlier. This feature prevents the attacker from accessing the web app in an authenticated session. When this feature removes session IDs, FortiWeb does not generate a log message because it is very common for a legitimate user to access a web application using an existing cookie. For example, a client who leaves his or her web browser open between sessions presents the cookie from an earlier session. Caution: This option is not supported in Offline Protection mode. |
disable
|
|
|
Enable to limit the number of concurrent logins per account. |
disable
|
|
|
Specify the maximum number of concurrent logins using the same account. |
1 |
|
|
When a session is idled for the specified period of time, the Concurrent Users count will be renewed. The user who is timed-out needs to re-log in. The valid range is 1-1440. |
30 |
|
|
Enable to set the time in minutes that FortiWeb waits before it stops tracking an inactive user session. |
disable
|
|
|
Enter If a session exceeds the timeout threshold, instead of tracking subsequent matching sessions by user, FortiWeb takes the specified action, for a length of time specified by |
disable
|
|
|
Enter the length of time in minutes that FortiWeb waits before it stops tracking an inactive user session. The valid range is 1–60. |
30
|
|
|
Enter the length of time after a session exceeds the timeout threshold that FortiWeb takes the specified action against requests with the ID of the timed-out session. After the freeze time has elapsed, FortiWeb removes the session ID for idle sessions but no longer takes the specified action. Available only when session-timeout-enforcement {enable | disable} is |
30
|
|
|
session-frozen-action {alert | alert_deny | redirect | block-period | deny_no_log} |
When session-timeout-enforcement {enable | disable} is
When the action generates a log message, the message field value is Available only when session-timeout-enforcement {enable | disable} or credential-stuffing-protection {enable | disable} is set to |
alert
|
|
Enter the number of seconds to block requests with the ID of a timed-out session or when credential-stuffing-protection {enable | disable} is enabled and detects spilled username/password pairs. This setting is available only if session-frozen-action {alert | alert_deny | redirect | block-period | deny_no_log} is |
600
|
|
|
When the session timeout settings generate an attack log, each log message contains a Severity Level (
Available only when session-timeout-enforcement {enable | disable} or credential-stuffing-protection {enable | disable} is set to |
Low
|
|
|
Enter the name of the trigger, if any, to apply when FortiWeb detects requests with the ID of a timed-out session or when For details, see log trigger-policy. To display the list of existing triggers, enter:
|
No default. | |
|
Enter the authentication result that FortiWeb associates with requests that match the criteria but do not match an entry in the Authentication Result Condition Table. When the login result is successful, FortiWeb tracks the session using the session ID and username values. |
failed
|
|
|
Enable to use FortiGuard's Credential Stuffing Defense database to prevent against Credential Stuffing attacks. For details, see the FortiWeb Administration Guide: |
disable
|
|
|
Enter the index number of the individual entry in the table. |
No default. | |
|
Specify the status FortiWeb assigns to user logins that match this table item: FortiWeb tracks sessions by user only when the status is If the request does not match any rules in this table, FortiWeb uses the value specified by default-action {failed | success}. |
success
|
|
|
HTTP-match-target {return-code | response-body | redirect-url} |
Select the location of the value to match with the string or regular expression specified in this table item: |
return-code
|
|
Indicate whether |
plain
|
|
|
Enter the value to match. |
No default. |
Example
This example matches requests from clients using the URL /login2 with the parameters user and pass and a session ID specified by jsessionid. FortiWeb tracks matching sessions by user and stops tracking if the client logs out using the URL /logout2.
FortiWeb tracks only requests with the return code 200, which it classifies as successful. It does not track requests with a response body that matches the regular expression deny. In addition, because the rule uses the default value for the default authentication result, it does not track requests that do not match an item in the list of match conditions.
The rule enables both session fixation protection and session timeout enforcement for tracked sessions. If a session is idle longer than the default session timeout, FortiWeb blocks requests from clients that use the session ID that has timed out for the default period block time. It performs this action for 30 minutes after the session times out (the default session freeze time).
config waf user-tracking
edit "rule1"
set authentication-url "/login2"
set username-parameter user
set password-parameter pass
set session-id-name "jsessionid"
set logoff-path "/logout2"
set session-fixation-protection enable
set timeout-enforcement enable
set session-frozen-action period-block
set session-frozen-severity High
set session-frozen-trigger "trigger1"
config match-condition
edit 1
set authentication-result-type success
set HTTP-match-target return-code
set value-type plain
set value 200
next
edit 2
set authentication-result-type failed
set HTTP-match-target return
set value-type regular
set value deny
next
end
next
end