Technical Tip: FortiWeb attack logs show for FortiWeb 'File name [blob]: Illegal file type'

[tnazarov]

Description	This article describes why FortiWeb attack logs may display the file name as an illegal file type, even when File Security is properly configured in FortiWeb.
Scope	FortiWeb 7.0.0 and later.
Solution	Attack log: Sometimes, the message 'File name [blob]: Illegal file type' may appear even after configuring File Security in FortiWeb, leading to the assumption that FortiWeb is not correctly detecting the file type. For example, if FortiWeb is set to block the 'pdf' file extension but fails to detect the file type when a PDF file is uploaded, it may not enforce the block as expected. But, FortiWeb can perceive the files with file extension names and some keywords in file content, it is up to how to select the files File Security Rule in File Security. If the file type under other file categories is selected, FortiWeb will check the keywords in the file content to match the file. If the file type under Whole Suffixes Files and other file categories is selected, FortiWeb will check both the file extension name and the keywords in the file content to match the file.