circulate-url-decode {enable | disable}

Enable to detect URL-embedded attacks that are obfuscated using recursive URL encoding (that is, multiple levels’ worth of URL encoding).

Encoded URLs can be legitimately used for non-English URLs, but can also be used to avoid detection of attacks that use special characters. Encoded URLs can now be decoded to scan for these types of attacks. Several encoding types are supported.

For example, you could detect the character A that is encoded as either %41, %x41, %u0041, or \t41.

Disable to decode only one level’s worth of the URL, if encoded.

decoding-enhancement {enable | disable}

Enable to decode cookies and parameters using base64 or CSS for specified URLs. To configure decoding enhancement, see system decoding enhancement.

max-cache-size <cache_int>

Type the maximum size (in KB) of the body of the HTTP response from the web server that FortiWeb will cache per URL for body compression, decompression, rewriting, and XML detection.

Increasing the body cache may decrease performance.

Valid values range from 32 to 10240. The default value is 64.

Increasing the body cache may decrease performance.

max-dlp-cache-size <percentage_int>

Type the maximum percentage of max-cache-size <cache_int>—the body of the HTTP response from the web server—that FortiWeb buffers and scans.

Responses are cached to improve performance on compression, decompression, and rewriting on often-requested URLs.

max-dos-alert-interval <seconds_int>

share-ip {enable | disable}

Enable to analyze the ID field of IP headers in order to attempt to detect when multiple clients share the same source IP address. To configure the difference between packets’ ID fields that FortiWeb will treat as a shared IP, see system ip-detection.

Enabling this option is required for features that have a separate threshold for shared IP addresses. If you disable the option, those features will behave as if there is only a single threshold, regardless of whether the source IP is shared by many clients.

anypktstream {enable | disable}

max-bot-alert-interval <interval_int>

ignore-undefined-query-param {enable | disable}

Enable to bypass undefined query parameters in policies.

key-attr {enable | disable}

Requests with certain content types, such as PDF, tend to have extremely long parameter names or non-printable characters. While these characteristics are legitimate, they are prone to triggering signatures, resulting in unnecessary resource consumption and numerous false positives.

To avoid such situations, you can enable key-attr. This feature allows requests with extremely long parameter names or non-printable characters to bypass scanning and be directly forwarded to the back-end server.

However, it's important to note that in certain content types listed below, an unusually long parameter name or non-printable characters can actually be an indicator of attacks. In these cases, FortiWeb will conduct a security scan on requests with these content types, regardless of the key-attr settings. Additionally, if the content-type header is absent, the request will be treated as high-risk, prompting a security scan as well.

• multipart

• soap+xml

• text/xml, application/xml,application/vnd.syncml+xml, application/vnd.ms-sync.wbxml

• multipart/form-data (boundary is required)

• text/html

• application/x-www-form-urlencoded

• text/plain

• text/css

• application/x-javascript

• multipart/x-mixed-replace

• application/javascript

• text/javascript

• application/rss+xml

• message/HTTP

• application/json, text/json

• all other application/...xml

key-max-length <int>

If the parameter name exceeds the max length value you have specified, FortiWeb will skip the security check and directly pass it on to the back-end server.

The valid range is 1-1,024.

key-printable {enable | disable}

If this option is enabled, all the characters in the parameter name must be printable. Otherwise FortiWeb will skip the security check and directly pass it on to the back-end server.

If this option is disabled, regardless whether the characters in the parameter name is printable or not, it should be proceeded for security check.