HTTP Parsing Error Log in FortiWeb: How to Disable or Solve?

[Mostafa85]

Hello,

I’m encountering a persistent issue on my FortiWeb device. In the logs, I consistently see entries like:

Main Type=HTTP Parsing Error, Sub Type=HTTP Parsing Error Action=alert_Deny

To troubleshoot, I have disabled both “Malformed Request” and “Malformed URL” options under HTTP Protocol Constraints. However, these logs are still being generated, and the traffic is denied.

I have checked the configuration but couldn’t find any explicit setting to disable or further tune the handling of HTTP Parsing Errors.

My questions:

Is there a way to disable or adjust the detection for HTTP Parsing Errors?
What else could trigger this log even after disabling the relevant protocol constraints?
Are there any hidden or advanced settings I should be aware of?
Any suggestions or documentation references would be greatly appreciated!

Thank you.

[AEK]

Hi Mostapha

Probably related to HTTP protocol constraints, HTTP headers or too many HTTP parameters.

But meanwhile, while investigating the issue, you may want to mitigate the false positive by turning it ti Alert instead of Alert_Deny.

You can do so from the alert log > double-click on the related log entry, click on the attack description (blue link) then click "Alert Only".

[Mostafa85]

Hi, thanks for your reply.

I’ve done some more troubleshooting on this issue:

I searched for any configuration with the alert_Deny action but couldn’t find any rule or policy set to this action.
I even exported the entire FortiWeb configuration and searched for “Alert_Deny” – but there’s nothing in the config referencing this action!

I’m really confused about where FortiWeb is getting this action from and why it’s still being triggered, even after disabling the relevant protocol constraints.

Any ideas on where else this could be coming from, or how to fully disable these HTTP Parsing Error logs?

Thanks again for any help!

[AEK]

Hello Mostafa

If you don't find Alert_Deny in the config that is probably because it is a default value in this case.

Did you try to mitigate the false positive as I suggested above?

Can you share a screenshot of the detailed log (right pan)?

[Mostafa85]

Thank you again for your reply.

Yes, I have checked and tried changing some configurations as you suggested, but the issue still persists.

I am attaching a screenshot of the detailed log (right pane) for more information.

Thanks for your help!

[filiaks1]

Maybe see if double URL decode helps as well ?

Advanced settings