Step 1: Confirm SCF configuration
If your Web service has enabled Tencent Cloud SCF (Serverless Cloud Function), you can add domain names for protection in the SCF WAF instance. Log in to the Serverless console, select Function Service in the left sidebar, and check whether SCF is being used. Step 2: Add Domain and Bind SCF
1. Log in to the WAF console. At the top of the left sidebar, switch the console to the region where your instance resides (Chinese mainland/Non-Chinese mainland). 2. In the left sidebar, choose Connection Management > Domain Onboarding.
3. On the Domain names page, click Add domain, enter the relevant configuration parameters, and click OK.
Field Description
Associated instance: Select the Cloud-native type and the corresponding Cloud-native WAF instance name.
Domain name: In the domain input box, enter the domain to protect, for example, test.com.
Traffic source: Select Cloud Function.
Use proxy: Select whether to use proxy services such as Anti-DDoS, CDN, or Cloud Acceleration based on your actual business requirements.
Select No: Requests received by WAF come directly from the client. WAF uses the IP address that establishes the connection with the client as the client IP address.
Select Yes: Requests received by WAF come from other layer-7 proxy services. To obtain the real client IP address for security analysis, you need to configure the client IP address determination method:
First IP in X-Forwarded-For
Network layer remote_ip (prevent XFF forgery)
IP in the specified header
Note:
It is recommended to store the client IP address in a custom Header within your business application and configure the corresponding Header field in WAF. This approach reduces the risk of attackers bypassing WAF protection rules by forging the XFF field, thereby enhancing business security.
Outside Mainland China: Selected based on actual requirements.
Protected Object Group: Select the protected object group corresponding to the bound web rule template. The custom web rule template takes effect automatically.
Remarks: Enter remarks for the domain name (optional) to facilitate subsequent management and identification of the domain's purpose.
Tag: Configure resource tags for access domains. Tags can be assigned based on tag keys and values. After tags are configured, you can search for and filter domain names by tags in the domain list. Tags can also be used for billing and permission management.
Click Add Tag to add a new tag key-value pair.
You can use the Key-Value Clipboard to batch paste existing tag key-value pairs.
The system supports quickly selecting previously used tags from the Historical Records.
4. After clicking OK, you will return to the Domain Access page where you can view information such as the protected domain name, Gateway Instance ID, and name.
1. After completing the previous steps, return to the SCF console. On the Custom Domain page, select to enable WAF and choose the corresponding instance ID from the WAF instance dropdown list. For more details, see the SCF Product Documentation.
Step 3: Verification Test
Enter the URL http://test.com/?test=alert(123) (a request simulating a Web attack) in your browser and access it. The browser returns a block page, indicating that the WAF protection feature is functioning normally.
Attention:
test.com is the example domain name in this case. Replace it with the actual domain name you added.