Setup Web Application Settings
Last updated
Was this helpful?
Last updated
Was this helpful?
Configuring is easily done by configuring the relevant asset using its basic details, and in the vast majority of the cases, is enough to protect the web assets without additional manual changes.
There are, however, advanced options that a security administrator can configure to modify the security to his specific requirements.
Browse to Assets, edit the web application asset object you have created and click on the "Web Attacks" Tab and look at the "Web Attacks" sub-practice configuration.
Setting the Mode to As Top Level means inheriting the primary mode of the practice.
Otherwise you can override it only for this specific sub-practice to Detect/Prevent/Disable.
The option Activate when confidence is becomes available if practice or sub-practice are set to Prevent. The value determines the threshold in which open-appsec will block attacks and prevent them, rather than just send a log according to Log Trigger configuration.
When clicking on Advanced additional advanced settings appear:
For all Size Limits - open-appsec Web Attacks engine will accept traffic that exceeds the limits if set to Detect/Learn mode (and that traffic will bypass inspection), or block traffic that exceeds the limits if set to Prevent mode.
URL Size (Bytes)
Determines the URL size limit for inspection
Max Object Depth
Determines the depth limit of a JSON/XML object inspected in the HTTP request. This includes embedded XML in JSON and the opposite.
Body Size (Kilobytes)
Determines the HTTP body size limit for inspection
Header Size (Bytes)
Determines the HTTP header size limit for inspection
CSRF Protection
Error Disclosure
Open Redirect
Non-Valid HTTP methods
When set to No and practice is set to Prevent, non-valid HTTP methods are blocked. Valid HTTP methods are:
GET, POST, DELETE, PATCH, PUT, CONNECT, OPTIONS, HEAD, TRACE
MKCOL, COPY, MOVE, PROPFIND, PROPPATCH, LOCK, UNLOCK, VERSION-CONTROL, REPORT, INDEX, CHECKOUT, CHECKIN, UNCHECK, MKWORKSPACE, UPDATE, LABEL, MERGE, BASELINE-CONTROL, MKACTIVITY, ORDERPATCH, ACL, SEARCH, MKREDIRECTREF, BIND, UNBIND
open-appsec includes additional security engines other in addition to the Machine Learning based-Web Attacks protection and API attacks protection:
Determines the mode for the advanced CSRF protection, which blocks . Important - This protection has a performance impact.
Determines the mode for the advanced Error Disclosure protection, which replaces and injects a different response instead. Important - This protection has a performance impact.
Determines the mode for the advanced Open Redirect protection, which prevents (e.g. as used by Phishing attacks) Important - This protection has a performance impact.
