grpc-security_rule_name

host-status {enable | disable}

host <host_str>

url <url_str>

The URL of the gPRC API request you want to protect.

You can enter the literal URL, such as /folder1/index.htm that the HTTP request must contain in order to match the rule, or use wildcards to match multiple URLs, such as /folder1/* or /folder1/*/index.htm. The URL must begin with a slash ( / ).

Enter the name of the IDL file you have uploaded in the gRPC IDL File tab in Web Protection > Protocol > gRPC.

FortiWeb will decode the traffic according to the IDL file.

Specify the maximum number of messages within a gRPC API request.

Specify the maximum size of each message body in a gRPC API request.

The name of message in the gRPC API request. FortiWeb will apply this gRPC security rule to the matched message.

The format should be "<package_name>.<message_name>", for example routeguide.Point. It's case sensitive.

The name of message in the gRPC API response. FortiWeb will apply this gRPC security rule to the matched message.

Refer to req-message-name for the format of the name.

action {alert | deny_no_log | alert_deny | block-period}

Select which action the FortiWeb appliance will take when it detects a violation.
Alert—Accept the connection and generate an alert email and/or log message.
alert_deny—Block the request (or reset the connection) and generate an alert and/or log message.
deny_no_log—Block the request (or reset the connection).

block-period—Block subsequent requests from the client for a number of seconds. Also configure waf grpc-security rule.

block-period <int>

If action is block-period, type the number of seconds that the client will be blocked.

Select the severity level to use in logs and reports generated when a violation of the rule occurs.

replace-response {enable | disable}

For gRPC API traffic, FortiWeb now supports obscuring sensitive data in server's response if it matches the Information Disclosure and Personally Identifiable Information signatures.

FortiWeb will detect any sensitive data in the back-end server's response and replace it with "xxx".

Please note that to make this function work, ensure that the Action for Information Disclosure and Personally Identifiable Information has been set to Erase or Erase & Alert in Web Protection > Known Attacks > Signatures.