Rule Execution Order
Unduh
Mode fokus
Ukuran font
A WAF protection policy contains multiple protection modules. This document describes the rule execution order, processing logic, and inter-module relationships of each module, helping you understand the complete request inspection process in the WAF engine so that you can configure protection policies more effectively.
Execution Flowchart
Overview
After a request reaches WAF, the engine inspects and handles the request layer by layer in a specific order based on the modules enabled in the current protection policy. Some modules are executed serially, while others are executed in parallel.
Allowlist-Based Priority Forwarding Mechanism
If a request matches the precise allowlist, the inspection modules that are skipped by the allow rule configuration will take effect. If a request matches the IP address allowlist, the request is directly allowed, and all subsequent protection rules no longer take effect.
Note:
The allowlist has the highest priority. If a legitimate request is mistakenly blocked, you can add the source IP address or signature to the allowlist to ensure that it is not affected by any protection rules.
Execution Relationship Between Browser Bot Defense and CC Protection
Browser bot defense takes precedence over CC Protection. Requests blocked by the Between Browser bot defense module return an HTTP 403 status code and do not enter the CC Protection process. Therefore, 403 status codes in attack logs may come from either the Browser bot defense module or the CC Protection module.
Attention:
When troubleshooting attack logs, identify the source module of 403 status codes so that you can accurately determine the attack type and adjust protection policies.
Intra-Module Rule Processing Logic
Within the same protection module, when a request matches multiple rules, the following processing logic applies:
Rules with higher priority are executed first: A smaller priority value indicates a higher priority. The engine checks rules in descending order of priority. For example, priority 1 is higher than priority 10.
Execution of rules with the same priority: Among rules with the same priority within the same module, the rule with the most recent modification time is automatically matched first.
Execute on Match: When a request matches a rule, the handling action configured for that rule (such as Block, Observe, or Human-Machine Recognition) is executed immediately.
Exit the Current Module: After a rule is matched and its handling action is executed, the request is no longer matched by subsequent rules in the current module, but it continues to enter the next protection module for inspection unless the action is Allow or Block.
Must-Knows
Rule Conflict: If the same request matches multiple rules in different modules at the same time, the handling actions are ordered by the module that is executed first (Block > Human-Machine Recognition > JS Validation > Observe). The allowlist module is executed before all protection modules.
Log Query: In attack logs, you can view request logs except those that match the precise allowlist and IP address allowlist, helping you analyze the reasons for request handling. For details, see Attack Logs.
Bantuan dan Dukungan
Apakah halaman ini membantu?
Anda juga dapat Menghubungi Penjualan atau Mengirimkan Tiket untuk meminta bantuan.
masukan