Configuring a Hidden Field rule
Define the Hidden Field rule for Input Validation to check for hidden parameters from <input type="hidden"> HTML tags. These hidden parameters are often written into an HTML page by the web server when it serves that page to the client, and is not visible on the rendered web page.
The Hidden Field rule function can do the following:
- Check the HOST by simple string or regular expression matching.
- Check the URL by simple string or regular expression matching.
- Match the configuration of the fetched URL.
If the conditions are successfully matched, it will execute the specified action.
To configure a Hidden Field rule:
- Go to Web Application Firewall > Input Validation.
- Click the Hidden Field tab.
- Click Create New to display the configuration editor.
- Configure the following Hidden Field settings:
Setting
Description
Name
Enter a unique name for the Hidden Fields rule. Valid characters are
A-Z,a-z,0-9,_, and-. No space is allowed.Note: Once saved, the name of a Hidden Field rule cannot be changed.
Host Status
Enable to require that the Host: field of the HTTP request match a protected host name's entry in order to match the URL access rule. Also configure Host.
Host
The Host option is available if Host Status is enabled.
Select which protected host name's entry (either a web host name or IP address) that the Host: field of the HTTP request must be in to match the URL access rule.
Request URL
The HTTP request URL must be start with /. eg./login. This item must be set when configuring the rule. FortiADC will match the other item (rule) when matching the request URL; if the match fails, FortiADC will not attempt to match others.
Action
Select the action profile that you want to apply. See Configuring WAF Action objects.
The default value is Alert.
Severity
When FortiADC records violations of this rule in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level FortiADC uses when using Input Validation:
- Low
- Medium
- High
The default value is Low.
- Click Save.
Once the Hidden Field configuration is saved, the Post URL and Hidden Fields sections can be configured. - Under the Post URL section, click Create New to display the configuration editor.
- In the URL field, specify the Post URL on which the hidden fields function can work. Click Save and exit the configuration dialog.
- Under the Hidden Fields section, click Create New to display the configuration editor.
To apply this feature, you must enable Session Management in your protection profile.
- In the Name field, enter a unique Hidden Fields name. It must match the value of the name in the input type of the HTML request. Click Save and exit the configuration dialog.
- Click Save to update the Hidden Field configuration.
After the Hidden Field rule has been saved, you can include it in an Input Validation Policy.