| Solution |
Some resources in a published web site can be accessed using URLs with query strings that add additional information. These kind of URL can be blocked using a URL access policy.
For example, to block URL https://www.usbwebcosas1.com/?q=user, the following configuration will block the web traffic with the URI '/?q=user' and will allow all other traffic to this site.
- Go to Web Protection -> Access -> URL Access. Under 'URL Access Parameter', select 'Create New':
- Write a name to the new URL Access Parameter and then select OK. After that, select 'Create New':
- In the New Parameter Rule, based on the URL https://www.usbwebcosas1.com/?q=user, configure the following parameters:
- Name Type: Simple String
- Name: q
- Use Type Check: Enable
- Argument Type: Regular Expression
- Regular Expression: user
After configuring these settings, select 'OK'. Then, under 'Edit URL Access Parameter', select 'OK'.
- Go to the URL Access Rule and then select 'Create new':
- Write a name for the new URL Access Rule and configure the following settings:
- Action: Alert & Deny.
- Severity: High.
After configuring these settings, select 'OK'. Then, select 'Create New' to create a new URL Access Condition.
- In the new URL Access Condition, configure the following settings:
- URL Type: Simple String.
- URL Pattern: /*
- URL Access Parameter: Select the URL Access Parameter created in point 3.
- Meet this condition if: Object matches the URL Pattern and Parameters.
Leave all other options disabled. After, select OK. Then, under 'Edit URL Access Rule', select OK.
- Go to URL Access Policy and then select 'Create new':
- Write a name to the new URL Access Policy and then select OK. After that, select 'Create New':
- While configuring a New URL Access Item: under 'Access Rule Name', select the Access Rule created in steps 5 and 6, then select OK:
- To use this configuration, the created URL Access policy must be configured in a web protection profile. Go to Policy -> Web Protection Profile and open the web protection profile configured in the server policy which is publishing the web service.
If the policy does not have a web protection profile, create a new one.
- In the Web Protection profile, go to Access -> URL Access and select the URL Access policy created in steps 8 and 9, then select OK:
- Go to Policy -> Server Policy, select the server policy or HTTP content routing policy that is publishing the web service and confirm the web protection profile is applied.
After that, when users try to access this, traffic will be blocked. For example, if a user uses a browser to access the configured URL, a block page will be showed:
This blocked traffic can be checked by viewing the attack log under Log & Report -> Log Access -> Attack:
Related document:
Restricting access based on specific URLs
|
