Will fortigate WAF scan for XSS or SQL injections with a flow mode rules in newer versions?

[filiaks1]

For some reason the  XSS or SQL injections are moved to a seperate WAF profile in Fortigate and not in the normal IPS functions but I saw the below article:

Stream-based antivirus scanning for HTML and Javascript files | FortiGate / FortiOS 7.6.0 | Fortinet...

As I have test fortigate I confirmed with proxy mode rule and WAF feature enabled that basic web attacks are detected but in the newer trial versions proxy rules can't be used because of the RAM limit, so I can't test if now the newer versions can scan web traffic with a flow rule not only for antivirus.

If anyone can confirm if not now then in the future flow mode rules will support WAF profiles it will be great as at the moment even the waf profile is not visible under flow rules in the trial option!

I know that FortiWeb is a true WAF that has auto policy building with url, header and parameter learnings, API protections and discoveries, Javascript Bot Protections that use AI/ML but for basic security of a non impotant web servers fortigate could be enough.

[sjoshi]

Hi @filiaks1 ,

Please refer below article:-

https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/64335/web-application-firewa...

You can apply WAF profiles to firewall policies when the inspection mode is set to proxy-based.

So if the device does not support proxy for small end model then WAF can not be implemented as it required proxy based policy

[filiaks1]

Thanks for confirming it. Still as mentioned in https://docs.fortinet.com/document/fortigate/7.6.0/new-features/518502/stream-based-antivirus-scanni... in 7.X fortigate can scan javascript and html files in stream mode, so why this has not been used for scanning WAF signatures with a flow based rule is strange  as that is something I focused on.

[sjoshi · Accepted solution]

While FortiOS has enhanced its antivirus engine to support stream-based scanning in flow mode—allowing partial buffering for HTML and JavaScript to reduce memory usage—this approach hasn't been extended to WAF signature scanning because WAF requires full HTTP session reconstruction to accurately analyze complex web traffic patterns, such as multipart forms, headers, and obfuscated attacks.

Which is why proxy based inspection is needed for WAF profile

[filiaks1]

Thanks for the info @sjoshi  !