"<json_rule_name>"

Enter a name that can be referenced by other parts of the configuration. You will use the name to select the rule in a JSON protection policy.

Enable to compare the JSON rule to the Host: field in the HTTP header. If enabled, also configure host "<host_name_str>".

Enter the name of a protected host that the Host: field of an HTTP request must match in order for the rule to apply. For details, see server-policy allow-hosts.

request-type {plain | regular}

Select whether request-type {plain | regular} must contain either:

• plain—The field is a string that the request URL must match exactly.
• regular—The field is a regular expression that defines a set of matching URLs.

request-file "<file_str>"

Depending on your selection for request-type {plain | regular}, enter either:

• plain—The literal URL, such as /index.php, that the HTTP request must contain in order to match the rule. The URL must begin with a slash ( / ).
• regular—A regular expression, such as ^/*.php, matching the URLs to which the rule should apply. The pattern does not require a slash ( / ), but it must match URLs that begin with a slash, such as /index.cfm.

Do not include the domain name, such as www.example.com, which is configured separately in host "<host_name_str>".

Schema-type {single-schema|schema-group}

Select whether to use a single schema file or a schema group. If a request does not match the schema it will be considered as a violation.

Schema-file <schema-file>

Select the schema file you have uploaded it through the JSON Schema tab in API Protection > JSON Protection in GUI.

Please note the schema file can't be uploaded through CLI.

Schema-group <schema-group>

Select the schema group you have created through config waf json-schema group. For more information, see waf json-schema group.

action {alert | alert_deny | block-period | redirect | send_403_forbidden | deny_no_log}

Select one of the following actions that FortiWeb performs when a request violates the rule:

• alert—Accept the request and generate an alert email and/or log message.

• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.

  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg.

• block-period—Block subsequent requests from the client for a number of seconds. Also configure block-period <period_int>.

• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.

• send_403_forbidden—Reply to the client with an HTTP 403 Access Forbidden error message and generate an alert email and/or log message.

• deny_no_log—Deny a request. Do not generate a log message.

Caution:FortiWeb ignores this setting when monitor-mode {enable | disable} is enabled.

Note: Logging and/or alert email will occur only if enabled and configured. For details, see log disk and log alertMail.

block-period <period_int>

Enter the amount of time (in seconds) that you want to block subsequent requests from a client after FortiWeb detects a rule violation. This setting is available only when action {alert | alert_deny | block-period | redirect | send_403_forbidden | deny_no_log} is block-period.

The valid range is 1–3,600 seconds.

severity {High Low | Medium | Info}

When rule violations are recorded in the attack log, each log message contains a Severity Level field. Select which severity level FortiWeb will use when it logs a violation of the rule:

• Low
• Medium
• High
• Info

trigger "<trigger_policy_name>"

Enter the name of the trigger, if any, to apply when the rule is violated. The maximum length is 63 characters. For details, see log trigger-policy.

To display a list of existing triggers, enter:

set trigger ?

json-limits {enable | disable}

Enable to define limits for data size, key, and value, etc.

json-data-size "<json-data-size_int>"

Enter the total size of JSON data in the JSON file. The valid range is 0–10240.

key-size "<key-size_int>"

Enter the key size of each object. The valid range is 0–10240. The

key-number "<key-number_int>"

Enter the total key number of each JSON file. The valid range is 0–2147483647.

value-size "<value-size_int>"

Enter the value size of each key. The valid range is 0–10240.

value-number-in-array "<value-number-in-array _int>"

Enter the total value number in an array. The valid range is 0–2147483647.

object-depth "<object-depth_int>"

Enter the number of the nested objects. The valid range is 0–2147483647.