WAF:override_action(action [, parameter])
Overrides the action that the WAF will take for the current transaction. This function is typically used within WAF event handlers to change the outcome, such as forcing a block, allowing a request, or challenging the client.
Syntax
WAF:override_action(action [, parameter]);
Arguments
The function requires an action string as the first argument. Certain actions require a second parameter.
|
Action |
Second Parameter |
Description |
|---|---|---|
| deny |
code (Integer) |
Terminates the request with the specified HTTP status code. Valid Codes: 200, 202, 204, 205, 400, 403, 404, 405, 406, 408, 410, 500, 501, 502, 503, 504. Default: 403 (if the code is invalid or not specified). |
| pass |
None |
Overrides any detected threat and allows the request to pass through. |
| captcha |
None |
Presents a CAPTCHA challenge to the client. The request is only allowed if the CAPTCHA is solved successfully. |
| block |
period (Integer) |
Blocks the client's IP address for the specified number of seconds.Range: 1 - 2147483647.Default: 3600 (if the period is invalid or not specified). |
| redirect |
url (String) |
Redirects the client to the specified URL. Note: The URL string must be valid and must be provided, otherwise the function will fail and return false. |
Events
Applicable in all WAF events:
-
WAF_REQUEST_ATTACK_DETECTED
-
WAF_RESPONSE_ATTACK_DETECTED
Example
when WAF_REQUEST_ATTACK_DETECTED {
local s = WAF:action()
debug("test WAF_REQUEST_ATTACK_DETECTED, action %s\n", s)
WAF:override_action("deny", 501);
}
Supported Version
FortiADC version 6.2.x and later.