azureazure-waf

Azure WAF exclusion, what's the difference between RequestArgNames and RequestArgValues?


I'm reading the docs and I just can't understand what's the difference between the match variables RequestArgNames and RequestArgValues.

Just by looking at the table, those two match variables seem to do the same thing (3rd and 5th rows): exclusion by match variable


What I would like to do, and which seems not to be possible, is to exclude the values ​​of some query params if the values ​​themselves contain a certain string.

e.g.:
Match variable: ?
Example selector: import
Uri: http://localhost:8080/?text=something-important&import=true&todo=gimport
What gets excluded: something-important and gimport


Solution

  • By referring to MSDoc, it is clearly mentioned that the RequestArgNames & RequestArgValues work in the same way in request attributes under WAF match exclusions as given below.

    Request attributes by names work the same way as request attributes by values and are included for backward compatibility with CRS 3.1 and earlier versions. We recommend you use request attributes by values instead of attributes by names.

    For example, if the request Uri is Uri: http://localhost:8080/?text=/etc/passwd, using match variable RequestArgNames or RequestArgValues excludes /etc/passwd as given in the above MS Doc.

    You can manage it accordingly in the WAF under Azure Portal as shown below.

    enter image description here

    In your example, the example selector you selected is import. It gets excluded the values which contains the import selector in the Uri.