Fortiweb: configuring chunked transfer encoding for HTTP 1.1 sites

Hello.

Thanks for your answer.

We've narrowed the issue down to one of the signature collections (known exploits and trojans) applied to the Web Protection Profile that the site is using, but we're still not sure on what going on. Let me give you some more info in order to see if you can help us understand why this is happening.

Just to be sure, we've started by disabling chunked encoding. In this case, everything worked out as expected: the FortiWeb  buffered the server's response and then it returned them to the client (all resources are returned with Content-Length header set).

Then, we've re-enabled chunked transfers by running the set chunk encoding enable command. We've enabled the Web Protection Profile and HTTP Protocol Constraints we had and we've went back to the original problem: FortiWeb  returns all responses to the client as chunked and limits its size to ~64Kb.

We've went ahead and disabled the HTTP protocol constraints. Again, no go: #FortiWeb returns everything as chunked and still limits the body size of all resources to 64kb. Clearly, the issue was not related with HTTP Protocol constraints, so we've re-enabled  it and disabled the signature policy from within the Web Protection Profile (Standard Protection section -> Signatures) that is being applied to the server. After doing this, everything started working properly, ie, only chunked server responses were sent as chunked to the client. The remaining resources are buffered and returned to the client with the appropriate Content-Length header (btw, the response's body is no longer limited to ~64Kb).

Clearly the issue is being caused by one of the signature's policy or policies, so we've tried to isolate the ones that are causing problems. Our tests show that if we have the "Known exploits", "Information Disclosure" or "Trojans" signature policy are enabled in the signature collection that is applied to the Protection Web Profile, then FortiWeb  will return all the resources as chunked and limit their sizes to ~64Kb (see next image). Each of those rule groups has several individual rules and I'm really not sure on which one is breaking everything...

Any reason why this is happening? I mean, why does activating these signatures transforms all server returned responses into chunked responses? More importantly, why do they abruptly terminate the server's response and limit it to 64Kbs?

In order to workaround this issue, we've ended up setting 2 content routing policy (for testing purposes only):

* one matches the host header that identifies the site AND all urls that end up in js or css: in this case, we apply a Web Protection Profile whose signatures don't use the "Known exploits", "Information Disclosure" or "Trojans" signatures. In practice, whenever a js or css resource is returned, #FortiWeb does not translate the server's buffered response into a chunked one (and more importantly, it does limit the response's body to ~64Kb)
* another one that matches only the host header: in this case, we apply the original Web Protection Profile that uses all the signature we had initially.

Yes, we could do it the other way around too (ie, if the url *does not* match js or css, then use the full signature; otherwise, use the limited signature group).

Is there a better option for solving this problem?

Finally, one more question: according to the docs, I should be able to diagnose issues with the diagnose debug flow filter module-detail chunk-decode 7 command. We've tried to use it, but apparently it doesn't do anything. Anyone knows if it works? If so, why am I unable to see anything in the output/logs?

Thanks.