Docs

Web Application Firewall

Policy priority

Priority of vulnerability protection policies

The allowlist addition mechanism of vulnerability protection is designed to create exemption rules for trusted business traffic, in order to prevent false positives caused by the strict detection engine of the WAF. Allowlist rules are mainly divided into two categories: request allowlist and field allowlist.

Request allowlist: Mark the entire HTTP request that meets specific criteria as trusted, allowing it to completely bypass the vulnerability detection engine.

Match variable allowlist: Only specific fields in the request (such as fields in the request header) are excluded from vulnerability detection, while the rest of the request remains subject to vulnerability detection. This is a more refined exemption method.

This document provides a detailed analysis of these two types of rules and explains in particular the hierarchical matching and priority logic of the "request allowlist" rule.

Request allowlist

In allowlist rule requests, the WAF evaluates whether a request should be allowlisted step by step in the order of protected domain > request path > advanced conditions. Only if the conditions at the current level are successfully matched will the system continue to match the rules at the next level.

The following are the descriptions of each configuration module and their internal priority order

Protected domain name

Specify the domains to be protected. You can select and add exact domains or wildcard domains.

Priority: exact domain name > wildcard domain name

Example:

Suppose you have two rules:

Rule A: The protected domain name is www.example.com (exact domain name)

Rule B: Protected domain: *.example.com (wildcard domain)

When a request to www.example.com arrives, the WAF will prioritize matching Rule A. An attempt to match rule B will only be made if the subsequent conditions of rule A, such as path or advanced conditions, are not met.

Request path

Specify the URL path of the target to be accessed; supports entering an exact path or using wildcards.*Matches any path.

Priority: exact path > wildcard path

Example:

For the domain www.example.com, you have configured two rules

Rule A: The request path is /login.php (exact path)

Rule B: The request path is /login/* (wildcard path)

When a request to www.example.com/login.php arrives, the WAF will match Rule A first. Only if the subsequent conditions for rule A are not met will the process continue to attempt to match rule B.

Advanced conditions

Used to set more granular matching criteria, such as request protocol, request method, request headers, request parameters, request body, request Cookie, request User-Agent, and so on. You can set multiple rules based on different request characteristics.

Priority: rules with advanced conditions > rules without advanced conditions

Note: Because advanced conditions enable precise matching of requests across multiple dimensions, rules with advanced conditions have higher priority than rules that are based only on the request path during rule matching.

Match variable allowlist

The design of the field allowlist rule is more straightforward and does not involve complex hierarchical priorities. It is a flat list of rules, with each rule consisting of the following two core elements:

Allowlist area: Defines the location of the field, such as Header, Path, Body, Cookie, and so on.

Allowlist field: Field name that needs to be exempt from inspection.

When performing vulnerability scanning, the WAF checks whether any field in the request matches any 'region+field' rule in the list. If the match is successful, skip the check for the value of this field and continue processing the remainder of the request.

Last updated: 2025.10.30 22:13:34