# Setup Web Application Settings

Configuring [Web Application security](https://docs.openappsec.io/getting-started/using-the-web-ui-saas/protect-additional-assets)  is easily done by configuring the relevant asset using its basic details, and in the vast majority of the cases, is enough to protect the web assets without additional manual changes.

There are, however, advanced options that a security administrator can configure to modify the security to his specific requirements.

## Web Application Protection Advanced Settings

### Web Attacks Settings

Browse to **Assets**, edit the web application asset object you have created and click on the "**Web Attacks**" Tab and look at the "**Web Attacks**" sub-practice configuration.

<figure><img src="https://1225393248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNcZmX14M2KdTBrq9EOnI%2Fuploads%2F8qicAtD2x4qwpIZe8NoP%2Fimage.png?alt=media&#x26;token=ffa702da-9ec6-4377-b00d-df338fdde6d6" alt=""><figcaption></figcaption></figure>

### Configuration Options

#### Mode override

Setting the Mode to **As Top Level** means inheriting the primary mode of the practice.

Otherwise you can override it only for this specific sub-practice to **Detect**/**Prevent**/**Disable**.

#### Confidence-dependent Prevent Mode

The option **Activate when confidence is** becomes available if practice or sub-practice are set to **Prevent**. The value determines the threshold in which open-appsec will block attacks and prevent them, rather than just send a log according to Log Trigger configuration.

<div align="left"><img src="https://1225393248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNcZmX14M2KdTBrq9EOnI%2Fuploads%2FlLZymXU43MRxkcgWKO3S%2Fappsec-assets-web-attacks-activate-dependent-on-confidence.PNG?alt=media&#x26;token=e7fcf097-9281-46bb-b406-ec6240a6b5a0" alt=""></div>

#### Advanced settings window

When clicking on **Advanced** additional advanced settings appear:

<div align="left"><img src="https://1225393248-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNcZmX14M2KdTBrq9EOnI%2Fuploads%2FU5nA4JWKA6iQDARbzPt5%2Fappsec-assets-web-attacks-advanced-settings.PNG?alt=media&#x26;token=7f3f53ec-5a22-4f4b-aff8-ba728bc25763" alt=""></div>

For all Size Limits - open-appsec Web Attacks engine will accept traffic that exceeds the limits if set to **Detect/Learn** mode (and that traffic will bypass inspection), or block traffic that exceeds the limits if set to **Prevent** mode.

<table><thead><tr><th width="150">Advanced Setting</th><th>Meaning</th></tr></thead><tbody><tr><td>URL Size (Bytes)</td><td>Determines the URL size limit for inspection</td></tr><tr><td>Max Object Depth</td><td>Determines the depth limit of a JSON/XML object inspected in the HTTP request. This includes embedded XML in JSON and the opposite.</td></tr><tr><td>Body Size (Kilobytes)</td><td>Determines the HTTP body size limit for inspection</td></tr><tr><td>Header Size (Bytes)</td><td>Determines the HTTP header size limit for inspection</td></tr><tr><td>CSRF Protection</td><td>Determines the mode for the advanced CSRF protection, which blocks <a href="https://owasp.org/www-community/attacks/csrf">CSRF attacks</a>. <br><strong>Important</strong> - This protection has a performance impact.</td></tr><tr><td>Error Disclosure</td><td>Determines the mode for the advanced Error Disclosure protection, which replaces <a href="https://owasp.org/www-community/Improper_Error_Handling">internal error codes in the response</a> and injects a different response instead.<br><strong>Important</strong> - This protection has a performance impact.</td></tr><tr><td>Open Redirect</td><td>Determines the mode for the advanced Open Redirect protection, which prevents<a href="https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/11-Client_Side_Testing/04-Testing_for_Client_Side_URL_Redirect"> client side redirection to other domains</a> (e.g. as used by Phishing attacks)<br><strong>Important</strong> - This protection has a performance impact.</td></tr><tr><td>Non-Valid HTTP methods</td><td><p>When set to <strong>No</strong> and practice is set to <strong>Prevent</strong>, non-valid HTTP methods are blocked.<br>Valid HTTP methods are:</p><ul><li>GET, POST, DELETE, PATCH, PUT, CONNECT, OPTIONS, HEAD, TRACE</li><li>MKCOL, COPY, MOVE, PROPFIND, PROPPATCH, LOCK, UNLOCK, VERSION-CONTROL, REPORT, INDEX, CHECKOUT, CHECKIN, UNCHECK, MKWORKSPACE, UPDATE, LABEL, MERGE, BASELINE-CONTROL, MKACTIVITY, ORDERPATCH, ACL, SEARCH, MKREDIRECTREF, BIND, UNBIND</li></ul></td></tr></tbody></table>

## Additional Security Engines

open-appsec includes additional security engines other in addition to the Machine Learning based-Web Attacks protection and API attacks protection:

{% content-ref url="../additional-security-engines/anti-bot" %}
[anti-bot](https://docs.openappsec.io/additional-security-engines/anti-bot)
{% endcontent-ref %}

{% content-ref url="../additional-security-engines/api-schema-enforcement" %}
[api-schema-enforcement](https://docs.openappsec.io/additional-security-engines/api-schema-enforcement)
{% endcontent-ref %}

{% content-ref url="../additional-security-engines/intrusion-prevention-system-ips" %}
[intrusion-prevention-system-ips](https://docs.openappsec.io/additional-security-engines/intrusion-prevention-system-ips)
{% endcontent-ref %}

{% content-ref url="../snort-rules/import-snort-rules" %}
[import-snort-rules](https://docs.openappsec.io/snort-rules/import-snort-rules)
{% endcontent-ref %}

{% content-ref url="../additional-security-engines/rate-limit" %}
[rate-limit](https://docs.openappsec.io/additional-security-engines/rate-limit)
{% endcontent-ref %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.openappsec.io/setup-instructions/setup-web-application-settings.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.