Apply a WAF rule set to a specific cookie

Run two WAF rule sets on one firewall, and score requests carrying a chosen cookie against the rule set that holds an exception.

Last updated

View as Markdown Agent setup

You can score requests that carry a chosen cookie against a different Web Application Firewall (WAF) rule set, from Azion Console. Use it when authenticated users, or an integrated third-party tool, need a policy the rest of your traffic does not.

The setup holds three objects:

  • A primary rule set scores every request the firewall receives.
  • A secondary rule set carries an exception for one internal rule on the Cookie header.
  • Two Rules Engine for Firewall rules select between them.

For the scoring model behind them, refer to Scoring and modes.

Prerequisites

Create the primary rule set

This rule set scores the traffic that does not carry the cookie. To create it:

Open the WAF Rules page

Access Azion Console > Edge Libraries > WAF Rules.

Select + WAF Rule
Name the rule set

In the General section, enter a Name. For example: storefront-primary.

Set the threat families

In the Threat Type Configuration section, set the Sensitivity of each threat family.

Keep the Active switch turned on
Save the rule set

The rule set appears in WAF Rules. It scores nothing yet: a rule set inspects requests only after a Rules Engine rule names it.

Create the secondary rule set

This rule set scores the traffic that carries the cookie, so give it the same policy as the primary one. To create it:

Select + WAF Rule

Still on the WAF Rules page, start a second rule set.

Name the rule set

In the General section, enter a Name. For example: storefront-cookie.

Repeat the threat families of the primary rule set

In the Threat Type Configuration section, set each Sensitivity to the value you gave the primary rule set.

Keep the Active switch turned on
Save the rule set

The two rule sets now carry the same policy. The exception in the next section is what makes them differ.

An exception stops one internal rule from firing in one place, and leaves it firing everywhere else. Azion Console calls an exception an allowed rule. To add one to the secondary rule set:

Open the secondary rule set

In WAF Rules, select the rule set you created in the previous section.

Select the Allowed Rules tab
Select + Allowed Rule
Select the rule to allow

In Rule ID, select the internal rule your cookie trips. This example uses 1005, Possible SQL Injection attack: MySQL keyword (|) found in Body, Path, Query String or Cookies.

Describe the exception

In Description, state why this rule is allowed.

Set the path

In Path, enter / to cover the whole site, or a narrower path to limit the exception.

Scope the exception to the cookie header

In Condition, select Specific HTTP Header Name, then enter cookie in Name.

Leave Operator at its default

Operator defaults to contains, which reads Name as a literal string rather than as a regular expression.

Save the allowed rule

The allowed rule appears in Allowed Rules, which lists its Rule ID, Description, Path, Conditions, and Status.

This exception relaxes one internal rule for the requests the secondary rule set scores. Every other rule in that rule set still scores them.

A cookie is supplied by the client and can be forged. Anyone who learns the cookie name and value sends the same header and reaches the secondary rule set. Hold the exception to one Rule ID and to the narrowest Path your application allows.

Apply the primary rule set to every request

A Rules Engine rule selects requests by its criteria, and its Set WAF behavior names one rule set and one mode. A rule carries at most one Set WAF behavior, which is why this setup takes two rules.

To create the first rule:

Open the firewall bound to your workload

In Azion Console, go to Firewalls and select that firewall.

Select the Rules Engine tab
Select + Rule
Name the rule

Enter a name for the rule. For example: Apply storefront-primary.

Set the criterion

In the Criteria section, select the Request Uri variable, the starts with comparison operator, and / as the argument.

Add the Set WAF behavior

In the Behaviors section, select Set WAF, then select the primary rule set.

Select Blocking as the mode
Save the rule

The firewall now scores every request it receives against the primary rule set.

This rule reads the Cookie header and sends the requests that carry your cookie to the secondary rule set.

A firewall processes its Rules Engine rules in the order they are arranged, so arrange this rule after the one you created in the previous section. To create it:

Select + Rule

Still on the Rules Engine tab, start a second rule.

Name the rule

Enter a name for the rule. For example: Apply storefront-cookie.

Set the criterion

In the Criteria section, select the Header Cookie variable, the matches comparison operator, and partner-access=b7c1f2e4 as the argument.

Enter your own cookie

Replace partner-access=b7c1f2e4 with the cookie your application issues. The matches operator reads the argument as a regular expression.

Add the Set WAF behavior

In the Behaviors section, select Set WAF, then select the secondary rule set.

Select Blocking as the mode
Save the rule

A request that carries the cookie is scored against the secondary rule set, so the allowed rule does not fire on its Cookie header, and every other rule in that rule set still scores it. A request without the cookie is scored against the primary rule set.

Next steps

WAF ExceptionsEvery field an exception carries, the fifteen conditions, and the Tuning screen.Tune a WAF rule setRead what a rule set matched and turn a false positive into an exception.Scoring and modesThe path a request travels, the scoring model, and what each mode does.Rules Engine for FirewallEvery criteria variable, comparison operator, and behavior a firewall rule can carry.