waf csrf-protection
Use this command to protect against cross-site request forgery (CSRF). CSRF is an attack that exploits the trust that a site has in a user's browser to transmit unauthorized commands.
The CRSF protection feature is not supported when the operation mode is Offline Protection or Transparent Inspection.
To protect back-end servers from CSRF attacks, you create two lists of items: a list of web pages to protect against CSRF attacks, and a corresponding list of the URLs found in the requests that the pages generate. For more information on configuring CSRF protection, including troubleshooting and adding parameter filters, see the FortiWeb Administration Guide:
HTTPS://docs.fortinet.com/fortiweb/admin-guides
To apply a CSRF protection rule, you select it in an inline protection profile. For details, see waf web-protection-profile inline-protection.
Before you configure a CSRF protection rule, if you want to apply it only to HTTP requests for a specific real or virtual host, you must first define the web host in a protected hosts group. For details, see server-policy allow-hosts.
To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.
Syntax
config waf csrf-protection
edit "<csrf-rule_name>"
set action {alert | alert_deny | block-period | deny_no_log}
set block-period <seconds_int>
set severity {High | Medium | Low | Info}
set trigger <trigger-policy_name>
config csrf-page-list
edit <entry_index>
set host <host_name>
set host-status {enable | disable}
set request-type {plain | regular}
set parameter-filter {enable | disable}
set parameter-name <parameter-name_str>
set parameter-value-type {plain | regular}
set parameter-value <parameter-value_str>
next
end
config csrf-url-list
edit <entry_index>
set host <host_name>
set host-status {enable | disable}
set request-type {plain | regular}
set parameter-filter {enable | disable}
set parameter-name <parameter-name_str>
set parameter-value-type {plain | regular}
set parameter-value <parameter-value_str>
next
end
next
end
| Variable | Description | Default |
|
Enter the name of a new or existing rule. The maximum length is 63 characters. To display the list of existing rules, enter:
|
No default. | |
|
Enter the action that FortiWeb takes when it detects a missing or incorrect anti-CSRF parameter:
Note: Logging and alert email occur only if the corresponding settings are enabled and configured. For details, see log disk and log alertMail. |
alert
|
|
|
Enter the number of seconds that you want to block subsequent requests from the client after the FortiWeb appliance detects a CSRF attack. The valid range is 1–3,600 seconds. This setting applies only if action {alert | alert_deny | block-period | deny_no_log} is block-period. |
600
|
|
| Select the severity level to use in any logs and reports that FortiWeb generates when a violation of this rule occurs. | Low
|
|
|
Enter the name of the trigger to apply when this rule is violated. For details, see log trigger-policy. The maximum length is 63 characters. To display the list of existing trigger policies, enter:
|
No default. | |
| Enter the index number of the individual entry in the table. | No default. | |
|
Enter a protected host name (either a web host name or IP address) that the This setting applies only if host-status {enable | disable} is |
No default. | |
Enter either a literal URL or regular expression, depending on the value of request-type. |
No default. | |
|
Enter Disable to match the rule based on the URL and any parameter filter only. |
disable
|
|
Select whether request-url <url_str> contains a literal URL (plain), or a regular expression designed to match multiple URLs (regular). |
plain
|
|
Enter enable to specify a parameter name and value to match.The parameter can be located in either the URL or the HTTP body of a request. |
disable
|
|
| Enter the name of the parameter name to match. | No default. | |
Select whether parameter-value <parameter-value_str> contains a literal value (plain) or a regular expression designed to match multiple parameters (regular). |
plain
|
|
| Enter either a literal parameter or regular expression, depending on the value of parameter-value-type {plain | regular}. To match any parameter value, for parameter-value-type, enter regular, and for parameter-value, enter * (asterisk). |
No default. |
Example
The web page csrf_login.html contains the following HTML form:
<form name="do_some_action" id="form1" action="csrf_test2.php" method="GET">
<input type="text" name="username" value=""/>
<Input type="text" name="password" value=""/>
<input type="submit" value="do Action"/>
</form>
This form generates the following request when the page is added to the list of pages protected by a CSRF protection policy:
http://target-site.com/csrf_test2.php?username=test&password=123&tknfv=3DF5BDCCIG3DCXNTE3RUNCTKRS3E36AD
The CSRF protection feature adds the parameter tknfv with a value that matches the session ID.
To create this example, you add csrf_login.html to the list of pages and /csrf_check2.php to the list of URLs.
config waf csrf-protection
edit "csrf_rule1"
set action alert_deny
config csrf-page-list
edit 1
set request-url "csrf_login.html"
set request-type regular
next
end
config csrf-url-list
edit 1
set request-url "/csrf_check2.php"
set request-type plain
next
end
next
end