Select the name of the signature set you have configured in Web Protection > Known Attacks, if any, that will be applied to matching requests.

To enable signature detection for API applications (XML, JSON, File Security, GraphQL, gRPC and WebSocket) make sure to enable signature detection in the relevant API Protection policy.

Attack log messages for this feature vary by which type of attack was detected. For a list, see Known Attacks .

Select the name of an HTTP parameter constraint, if any, that will be applied to matching requests. For details, see HTTP/HTTPS protocol constraints.

Attack log messages for this feature vary by which type of constraint was violated.

Select the X-Forwarded-For: and X-Real-IP: HTTP header settings to use, if any. For details, see Defining your proxies, clients, & X-headers.

Note: Configuring this option is required if the true IP address of the client is hidden from FortiWeb because a load balancer or other web proxy is deployed in front. In that case, you must configure an X-header rule so that FortiWeb will block only requests related to the original client. Otherwise, it may block all requests whenever any attack occurs, since all requests will appear to originate from the proxy’s IP.

Enable to track a client by the inserted cookie, or source IP when cookie is prohibited.
For details, see Client management.

This field appears only when a valid Client-Side Protection license is present.

Select the name of a Client-Side Protection policy. For details, see Client-Side Protection.

Note: To activate this policy, both an HTTP Header Security policy and a Subresource Integrity Policy must also be configured in the same Web Protection Profile.

Select the name of HTTP Header Security policy, if any, to apply to matching responses.

For details, see HTTP Security Headers.

Select the name of an SRI policy to enforce integrity on external resources. For details, Subresource Integrity (SRI) Check.

Select the name of an MiTB protection rule, if any, that will be applied to matching requests. For details, Man in the Browser (MitB) Protection.

Advanced Protection

Select the name of a combination source IP, rate limit, HTTP header, and URL access policy, if any, that will be applied to matching requests. For details, see Custom Policy.

Attack log messages contain Custom Access Violation when this feature detects a violation.

Select the name of cross-site request forgery protection rule, if any, to apply to matching requests. For details, see Defeating cross-site request forgery (CSRF) attacks.

Available only when Client Management is selected.

Select the name of a URL encryption policy if any, that will be applied to matching requests. For details, see URL encryption.

Select the name of a Link Cloaking policy if any, that will be applied to matching requests. For details, see Link cloaking.

Select the name of a SQL/XSS syntax based detection policy if any, that will be applied to matching requests. For details, see Syntax Based Detection.

Data Loss Prevention

Select the name of a Data Loss Prevention policy if any, that will be applied to matching requests. For details, see Data Loss Prevention.

Input Validation

Select the name of the parameter validation rule, if any, that will be applied to matching requests. For details, see Validating parameters (“input rules”).

Attack log messages contain Parameter Validation Violation when this feature detects a parameter rule violation.

Select the name of the hidden fields protection rule, if any, to use to protect hidden fields on your website. For details, see Preventing tampering with hidden inputs.

Attack log messages contain Hidden Field Manipulation when this feature detects tampering.

This option appears only when Client Management is enabled.

Select an existing file security policy, if any, that will be applied to matching HTTP requests. For details, see Limiting file uploads.

Attack log messages contain Illegal File Size when this feature detects an excessively large upload.

Select the name of a Web Shell Detection policy if any, that will be applied to matching requests. For details, see Web Shell Detection.

Select a File List configuration, if any, that will be applied to matching requests for Data Loss Prevention, File Security, and Web Shell Detection. For details, see Configuring a File List Policy.

Protocol

Select the name of a WebSocket Security rule, if any, that will be applied to matching requests. For details, see WebSocket protocol.

Select the name of a gRPC security rule, if any, that will be applied to matching requests. For details, see gRPC protocol.

Access

Select the name of the URL access policy, if any, that will be applied to matching HTTP requests. For details, see Restricting access based on specific URLs.

Attack log messages contain URL Access Violation when this feature detects a URL matched by this policy.

Select an existing allow method policy, if any, that will be applied to matching HTTP requests. For details, see Specifying allowed HTTP methods.

Attack log messages contain HTTP Method Violation when this feature detects a non-allowed HTTP request method.

Bot Mitigation

Select the name of an existing Bot Mitigation policy. For details, see Configuring bot mitigation policy.

API Protection

Select the name of an existing OpenAPI protection policy. For details, see Configuring GraphQL protection.

Select the name of an existing Mobile API Protection policy. For details, see Configuring mobile API protection.

Select the JWT verification method FortiWeb uses to authenticate mobile application requests. This setting determines how FortiWeb validates the authenticity of JWTs (JSON Web Tokens) provided by mobile clients, typically in the HTTP request headers.

Available options:

• jwt-token-secret: Verifies the token signature using a symmetric key (HMAC). You must specify a shared secret (JWT Secret) known to both the token issuer and FortiWeb.

• jwt-public-key: Verifies the token signature using an RSA public key. You must provide the public key in PEM format (JWT Public Key) for asymmetric verification.

• jwks-endpoint: Retrieves public keys dynamically from a remote JWKS (JSON Web Key Set) endpoint. You must configure the URI (JWKS Endpoint) pointing to the JWKS source. FortiWeb will periodically cache and refresh these keys for validation.

For all methods, you must also specify the Token Header, which indicates the HTTP header field (default: Jwt-Token) from which FortiWeb extracts the JWT for verification.

This setting is essential for enabling secure, token-based client identification in mobile API workflows.

DoS Protection

Application Delivery

Select the name of a URL rewriting rule set, if any, that will be applied to matching requests.

For details, see Rewriting & redirecting.

Select the name of a Waiting Room policy, if any, that will be applied to matching requests. For details, see Waiting room.

IP Protection

Enable to detect source IP addresses that a FortiGate unit is currently preventing from interacting with the network and protected systems. Then, select the action that FortiWeb takes if it detects a quarantined IP address:

• Alert—Accept the request and generate an alert email, log message, or both.
• Alert & Deny—Block the request and generate an alert, log message, or both.
• Deny (no log)—Block the request (or reset the connection).

Note: If FortiWeb is deployed behind a NAT load balancer and this option is enabled, to prevent FortiWeb from blocking all connections when it detects a violation of this type, define an X-header that indicates the original client’s IP. For details, see Defining your proxies, clients, & X-headers.

In addition, select a severity level and trigger policy.

For information on configuring communication with the FortiGate that provides the list of quarantined IP addresses, see Receiving quarantined source IP addresses from FortiGate.

Tracking

Redirect

Type a URL including the FQDN/IP and path, if any, to which a client will be redirected if:

• Its request violates any of the rules in this profile, and
• The Action for the rule is set to Redirect.

For example, you could enter:

www.example.com/products/

If you do not enter a URL, depending on the type of violation and the configuration, the FortiWeb appliance will log the violation, may attempt to remove the offending parts, and could either reset the connection or return an HTTP 403 Access Forbidden or 404 File Not Found error message.

Enable to include the reason for redirection as a parameter in the URL, such as reason747sha=Parameter%20Validation%20Violation, when traffic has been redirected using Redirect URL. The FortiWeb appliance also adds redirect491=1 to the URL to detect and cancel a redirect loop (if the redirect action would otherwise recursively triggers an attack event). FortiWeb will strip these two parameters before it forwards the processed traffic to the back-end servers.

By default, this option is disabled.

Caution: If the FortiWeb appliance is protecting a redirect URL, enable this option to prevent infinite redirect loops.