Technical Tip: How to configure Input Parameter Validation Policy and Rules

[kmak]

Description	This article describes how to configure the Input Parameter Validation policy and rules.
Scope	FortiWeb.
Solution	Prerequisite: The server policy is applied with the Parameter Validation policy. Before creating the Parameter Validation rule, find out the list of input parameters in a web page to be validated. In the example, the input parameters can be found using the browser’s Developer Tools. In FortiWeb, navigate to the Parameter Validation page and create a new Parameter Validation Rule. Add a name for the Parameter Validation Rule. Enable Host Status and insert the web host domain name if hostname matching is required. Insert the URL which contains the input parameters to be validated and select the action to be applied for the violated input. Select Create New to add the web page input parameter. Use the parameter name found on the web page. Insert the maximum length for each parameter to set the number limit of input characters. Enable Use Type Check and select the Data Type. Use regular expression or custom data type if wish to use custom input restriction. Create all the input parameter names that require to be validated and use the Data Type to restrict the input characters. Next, create a Parameter Validation Policy and associate the Parameter Validation Rule with the policy. Enable the created Parameter Validation policy in the custom Web Protection Profile. Once the policy is applied, test by sending some invalid characters in the webpage form. The request shall be blocked as the First Name parameter contains invalid characters. The Attack ID shall be 20000005 which indicates the violation of the Parameter Validation policy. Check out the FortiWeb attack logs to confirm if the blockage is related to the Parameter Validation policy violation. Related document: https://docs.fortinet.com/document/fortiweb/7.2.3/administration-guide/808674