Fortiweb 5.7 now support HTTP/2 . It's about time I thought and played around a little with that new version.
There is more on the new feature list that makes an update appealing:
- HTTP/2 is speedy
- A new method to detect SQL Injection attack: Using Lexical analysis with a SQL parser, SQL templates,
and Abstract Syntax Trees, FortiWeb can verify whether requests are true SQL Injection attacks. This virtually
eliminates SQL Injection false positives and false negatives.
- New HTTP Protocol Constraints
- New SSL/TLS Cipher Suites
- Packet Capturein GUI
- and more
Gladly the update went smooth this time. And no re-partitioning was needed.
But take care when using HTTP/2
Only few feature on your protection profile support HTTP/2 !
One dangerous scenarios is if e.g. you have protected a web server with authentication enforcement (site publish) on the WAF and then enable http/2 your authentication enforcement is gone and your web server open to the public. I really like the authentication enforcement on WAFs, but Fortis implementation is very fragile and only to use with extreme care and testing.
