Enforce HTTP RFC compliance

Citrix Web App Firewall inspects the incoming traffic for HTTP RFC compliance and drops any request that has RFC violations by default. However, there are certain scenarios, where the appliance might have to bypass or block a non-RFC compliance request. In such cases, you can configure the appliance to bypass or block such requests at global or profile level.

Block or bypass non-RFC compliant requests at global level

The HTTP module identifies a request as invalid if it is incomplete and such requests cannot be processed by WAF. For example, an incoming HTTP request having a host header missing. To block or bypass such invalid requests, you must configure themalformedReqActionoption in the application firewall global settings.

The ‘malformedReqAction’ parameter validates the incoming request for invalid content length, invalid chunked request, no HTTP version, and incomplete header.

Note:

If you disable the block option in themalformedReqActionparameter, the appliance bypasses the entire app firewall processing for all non-RFC compliance requests and forwards the requests to the next module.

To block or bypass invalid non-RFC complaint HTTP requests by using the command line interface

To block or bypass invalid requests, enter the following command:

set appfw settings -malformedreqaction

Example:

set appfw settings –malformedReqAction block

To display malformed request action settings

To display malformed request action settings, enter the following command:

show appfw settings

Output:

DefaultProfile: APPFW_BYPASS UndefAction: APPFW_BLOCK SessionTimeout: 900 LearnRateLimit: 400 SessionLifetime: 0 SessionCookieName: citrix_ns_id ImportSizeLimit: 134217728 SignatureAutoUpdate: OFF SignatureUrl:"https://s3.amazonaws.com/NSAppFwSignatures/SignaturesMapping.xml" CookiePostEncryptPrefix: ENC GeoLocationLogging: OFF CEFLogging: OFF EntityDecoding: OFF UseConfigurableSecretKey: OFF SessionLimit: 100000 MalformedReqAction: block log stats Done 

To block or bypass invalid non-RFC complaint HTTP requests by using the Citrix ADC GUI

1. Navigate toSecurity>Citrix Web App Firewall.
2. In theCitrix Web App Firewallpage, clickChange Engine SettingsunderSettings.
3. In theConfigure Citrix Web App Firewall Settingspage, select theLog Malformed Requestoption as Block, Log, or Stats.
4. ClickOKandClose.

Note:

If you unselect the block action or do not select any malformed request action, the appliance bypasses the request without intimating the user.

Block or bypass non-RFC compliant requests at profile level

Other non-RFC compliant requests can be configured to block or bypass at profile level. You must configure the RFC profile either in Block or Bypass mode. By doing this configuration, any invalid traffic that matches the Web App Firewall profile is either bypassed or blocked accordingly. The RFC profile validates the following security checks:

• Invalid GWT-RPC requests
• Invalid content type headers
• Invalid Multipart requests
• Invalid JSON requests
• Duplicate cookie name value pair checks

Note:

When you set theRFCprofile in “Bypass” mode, you must make sure you disable the transformation option in theHTML Cross-Site Scripting Settingsand in theHTML SQL Injection Settingssections. If you enable and set theRFCprofile in Bypass mode, the appliance displays a warning message, “Transform cross-site scripts” and “Transform SQL special characters” are both currently ON. Recommend turning it off when used withAPPFW_RFC_BYPASS.

Important:

Also, the appliance displays a warning note, “Appfw Security checks enabled might not be applicable to requests which violates RFC checks when this profile is set. Enabling any transformation setting is not recommended as requests might be partially transformed that contains RFC violations.”

To configure an RFC profile in the Web App Firewall profile by using the command line interface

At the command prompt, type the following commands:

set appfw profile -rfcprofile