Only Allow Access to Webpage if user hits certain directory first (Fortiweb)

[hcor87]

Hi, 

Our WebDevs have been having issues with getting hit with bots, and have determined that the bots never access a certain directory URL. All regular users hit this page with each page they load, I'm told. 

Is there a method, possibly with user management, to mark a user as valid and allow me to block the rest?

Thanks!

[sjoshi]

Hi,

To restrict access to a webpage based on users hitting a certain directory first on FortiWeb, you can utilize the session management feature in the web protection profile. By configuring FortiWeb to track the session initiation and previous HTTP requests, you can ensure that users access the specific directory before accessing other pages. This method helps differentiate between legitimate users who follow the expected page order and potential bots that do not access the required directory, allowing you to block unauthorized access effectively.

[hcor87]

Hi, 

Would you be able to provide a few more details, or which submenu in Web Protection I should drill into? All the documentation for things like a "start page" doesn't seem to exist in 7.2.10. I've searched the Cookbook and haven't seen anything on how to mark a user once they hit a certain directory. 

Thanks!

[saifmp_123]

Hi @hcor87 ,

You know the users accessing the directory URL are valid, and the rest are invalid. Since the bots are causing the main issue and don’t access the directory URL, you can try the following approach:

1. Blacklist Bot IPs:

   • Identify the IPs that send requests without ever accessing the trusted directory URL.
   • Collect those IPs and add them to a blacklist to prevent any future traffic from them to the application.

2. Bot Mitigation Policy with Rate Limiting:

   • Enable a bot mitigation policy in FortiWeb.
   • Apply rate limiting by setting thresholds for requests. When the request rate exceeds the configured threshold, FortiWeb will automatically block the bot IPs for a specified block period.

If both these approaches don’t resolve the issue, please let me know so we can explore further options.

Thanks..!!