HTTP Parsing Error Log in FortiWeb: How to Disable or Solve?

Hi Mostapha

Probably related to HTTP protocol constraints, HTTP headers or too many HTTP parameters.

But meanwhile, while investigating the issue, you may want to mitigate the false positive by turning it ti Alert instead of Alert_Deny.

You can do so from the alert log > double-click on the related log entry, click on the attack description (blue link) then click "Alert Only".

Hi, thanks for your reply.

I’ve done some more troubleshooting on this issue:

I searched for any configuration with the alert_Deny action but couldn’t find any rule or policy set to this action.
I even exported the entire FortiWeb configuration and searched for “Alert_Deny” – but there’s nothing in the config referencing this action!

I’m really confused about where FortiWeb is getting this action from and why it’s still being triggered, even after disabling the relevant protocol constraints.

Any ideas on where else this could be coming from, or how to fully disable these HTTP Parsing Error logs?

Thanks again for any help!

Thank you again for your reply.

Yes, I have checked and tried changing some configurations as you suggested, but the issue still persists.

I am attaching a screenshot of the detailed log (right pane) for more information.

Thanks for your help!

Maybe see if double URL decode helps as well ?

Advanced settings