Only Allow Access to Webpage if user hits certain directory first (Fortiweb)

Hi,

To restrict access to a webpage based on users hitting a certain directory first on FortiWeb, you can utilize the session management feature in the web protection profile. By configuring FortiWeb to track the session initiation and previous HTTP requests, you can ensure that users access the specific directory before accessing other pages. This method helps differentiate between legitimate users who follow the expected page order and potential bots that do not access the required directory, allowing you to block unauthorized access effectively.

Hi @hcor87 ,

You know the users accessing the directory URL are valid, and the rest are invalid. Since the bots are causing the main issue and don’t access the directory URL, you can try the following approach:

1. Blacklist Bot IPs:

   • Identify the IPs that send requests without ever accessing the trusted directory URL.
   • Collect those IPs and add them to a blacklist to prevent any future traffic from them to the application.

2. Bot Mitigation Policy with Rate Limiting:

   • Enable a bot mitigation policy in FortiWeb.
   • Apply rate limiting by setting thresholds for requests. When the request rate exceeds the configured threshold, FortiWeb will automatically block the bot IPs for a specified block period.

If both these approaches don’t resolve the issue, please let me know so we can explore further options.

Thanks..!!