Input Validation
The Input Validation module serves as a robust defense layer by enforcing strict requirements on data submitted by users. While signatures look for known malicious patterns, input validation focuses on ensuring that the data structure itself conforms to your application's expectations. By verifying inputs at specific scanpoints, including URL parameters, HTML forms, hidden fields, and file uploads, you can preemptively block malformed or suspicious requests before they reach your backend server.
The module allows you to implement a layered validation strategy through the following configuration tasks:
Configuring an Input Validation policy
This is the primary container for your validation logic. An Input Validation policy allows you to aggregate multiple specific rules into a single object that can be applied to a WAF profile. This provides the flexibility to create different validation requirements for different parts of your application, such as a strict policy for an administrative login and a more permissive policy for a public search bar.
Configuring a Parameter Validation rule
This task focuses on the specific data sent via URL parameters and HTML forms. You can define the expected data type, character sets, and length limits for each parameter. By ensuring that a "quantity" field only contains integers or that a "username" field does not contain special characters, you can effectively mitigate several classes of injection attacks.
Configuring a Hidden Field rule
Hidden fields are often used by developers to maintain state or store metadata within a form. Because these fields are not visible to the user, they are frequent targets for attackers who attempt to modify their values to manipulate application logic. This rule allows the FortiADC to sign or validate hidden fields to ensure their integrity has not been compromised during the round-trip between the server and the client.
Configuring a File Restriction rule
This task manages the security of file uploads. You can define permitted file extensions and set maximum file size limits a user can upload in a single request. Enforcing these restrictions is critical for preventing attackers from uploading malicious scripts, such as web shells, or attempting to exhaust server storage capacity.