Configuring the global object white list
Go to Server Objects > Global > Global White List, the Predefined Global White List tab displays a predefined list of common Internet entities, such as:
- the FortiWeb session cookie named
cookiesession1
- Google Analytics cookies such as
__utma
- the URL icon
/favicon.ico
- AJAX parameters such as
__LASTFOCUS
that your FortiWeb appliance can ignore when it enforces your policies. FortiGuard FortiWeb Security Service service updates the predefined global white list. However, you can also whitelist your own custom URLs, header field, cookies, and parameters on the Custom Global White List tab in Server Objects > Global > Global White List.
When enabled, white-listed items are not flagged as potential problems. This feature reduces false positives and improves performance.
To include white list items during policy enforcement, you must first disable them in the global white list.
To disable an item in the predefined global white list
- Go to Server Objects > Global > Global White List and select the Predefined Global White List tab.
- To see the items that each section contains and to expose those items’ Enable check box, click the plus (+) and minus (-) icons.
- In the row of the item that you want to disable, click the switch to off in the Enable column.
- Click Apply.
To access this part of the web UI, your administrator’s account access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.
To configure a custom global white list
- Go to Server Objects > Global > Global White List and select the Custom Global White List tab.
- Click Create New.
- From Type, select the part of the HTTP request where you want to white list an object. Available configuration fields vary by the type that you choose.
To access this part of the web UI, your administrator’s account access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.
- If Type is URL:
- The literal URL, such as
/robots.txt
, that the HTTP request must contain in order to match the rule. The URL must begin with a backslash ( / ). - A regular expression, such as
^/*.html
, matching all and only the URLs to which the rule should apply. The pattern does not require a slash ( / ); however, it must at match URLs that begin with a slash, such as/index.html
.
Request Type | Indicate whether the Request URL field will contain a literal URL (Simple String), or a regular expression designed to match multiple URLs (Regular Expression). |
Request URL |
Depending on your selection in the Request Type field, enter either: Do not include the domain name, such as To create and test a regular expression, click the >> (test) icon. This opens the Regular Expression Validator window where you can fine-tune the expression. For details, see Regular expression syntax. |
-
If Type is Parameter, in Name, type the name of the variable exactly as it appears in the URL or HTTP body (varies by HTTP
GET
/POST
method).For example, if the URL ends with the parameter substring
?userName=rowan
, you would typeuserName
(note the capital letter).
- If Type is Cookie:
Name | Type the name of the cookie as it appears in the HTTP request, such as NID . |
Domain |
Type the partial or complete domain name or IP address as it appears in the cookie, such as:
If clients sometimes access the host via IP address instead of DNS, create white list objects for both. Caution: Do not whitelist untrusted subdomains that use vulnerable cookies. It could compromise the security of that domain and its network. |
Path | Type the path as it appears in the cookie, such as / or /blog/folder . |
- If Type is Header Field:
- The literal name, such as
Accept-Encoding
, that the HTTP request must contain in order to match the rule. - A regular expression, such as
*/*\r\n
, matching the names to which the rule should apply. .
Header Name Type | Indicate whether the Name field will contain a literal name (Simple String), or a regular expression designed to match multiple names (Regular Expression). |
Name |
Depending on your selection in the Header Name Type field, enter either: To create and test a regular expression, click the >> (test) icon. This opens the Regular Expression Validator window where you can fine-tune the expression. For details, see Regular expression syntax. |