|
| 1 | +--- |
| 2 | +title: Response signatures |
| 3 | +weight: 1850 |
| 4 | +toc: true |
| 5 | +nd-content-type: reference |
| 6 | +nd-product: NAP-WAF |
| 7 | +nd-docs: DOCS-000 |
| 8 | +--- |
| 9 | + |
| 10 | +This page describes the response signatures feature of F5 WAF for NGINX. |
| 11 | + |
| 12 | +Response signatures are signatures detected in HTTP responses: [Attack signatures]({{< ref "/waf/policies/attack-signatures.md" >}}) are detected in HTTP requests. |
| 13 | + |
| 14 | +You may also want to view the [Allowed methods]({{< ref "/waf/policies/allowed-methods.md" >}}) topic. |
| 15 | + |
| 16 | +## Response codes |
| 17 | + |
| 18 | +F5 WAF for NGINX can be configured to selectively allow response codes while blocking all others. |
| 19 | + |
| 20 | +The `allowedResponseCodes` attribute is used to define which response codes are allowed as part of a comma-sepated list in the `general` block. |
| 21 | + |
| 22 | +The following example enables the response status codes violation in blocking mode. |
| 23 | + |
| 24 | +```json |
| 25 | +{ |
| 26 | + "policy": { |
| 27 | + "name": "allowed_response", |
| 28 | + "template": { "name": "POLICY_TEMPLATE_NGINX_BASE" }, |
| 29 | + "applicationLanguage": "utf-8", |
| 30 | + "enforcementMode": "blocking", |
| 31 | + "blocking-settings": { |
| 32 | + "violations": [ |
| 33 | + { |
| 34 | + "name": "VIOL_HTTP_RESPONSE_STATUS", |
| 35 | + "alarm": true, |
| 36 | + "block": true |
| 37 | + } |
| 38 | + ] |
| 39 | + }, |
| 40 | + "general": { |
| 41 | + "allowedResponseCodes": [ |
| 42 | + 400, |
| 43 | + 401, |
| 44 | + 403, |
| 45 | + 404, |
| 46 | + 502, |
| 47 | + 499 |
| 48 | + ] |
| 49 | + } |
| 50 | + } |
| 51 | +} |
| 52 | +``` |
| 53 | + |
| 54 | +## Restricted response length |
| 55 | + |
| 56 | +F5 WAF for NGINX can define a limit to the amount of bytes that will be inspected in a response. This feature is disabled by default, with a default length of 20,000 bytes when enabled. |
| 57 | + |
| 58 | +Restrictions on known signatures will be enforced by policies independently of response length. |
| 59 | + |
| 60 | +To enable this, set the `responseCheck` parameter to `true`. Add the `responseCheckLength` attribute to set an alternative length to the default value. |
| 61 | + |
| 62 | +The response length checked refers to the number of uncompressed bytes in the response body. |
| 63 | + |
| 64 | +Usually F5 WAF for NGINX will buffer only that part of the response saving memory and CPU, but in some conditions the whole response may have to be buffered, such as when the response body is compressed. |
| 65 | + |
| 66 | +The following example enables the `responseCheck` parameter with `responseCheckLength` set to `1000`, signifying that only the initial 1000 bytes of the response body should be inspected. |
| 67 | + |
| 68 | +It is nested within a [filetypes]({{< ref "/waf/policies/response-signatures.md" >}}) block. |
| 69 | + |
| 70 | +```json {hl_lines=[9, 13, 14]} |
| 71 | +{ |
| 72 | + "policy": { |
| 73 | + "name": "response_signatures_block", |
| 74 | + "template": { |
| 75 | + "name": "POLICY_TEMPLATE_NGINX_BASE" |
| 76 | + }, |
| 77 | + "applicationLanguage": "utf-8", |
| 78 | + "enforcementMode": "blocking", |
| 79 | + "filetypes": [ |
| 80 | + { |
| 81 | + "name": "*", |
| 82 | + "type": "wildcard", |
| 83 | + "responseCheck": true, |
| 84 | + "responseCheckLength": 1000 |
| 85 | + } |
| 86 | + ], |
| 87 | + "signature-sets": [ |
| 88 | + { |
| 89 | + "name": "All Response Signatures", |
| 90 | + "block": true, |
| 91 | + "alarm": true |
| 92 | + } |
| 93 | + ] |
| 94 | + } |
| 95 | +} |
| 96 | +``` |
0 commit comments