Check if 'Hold Session While Scanning File' is enabled first. When it is enabled, FortiWeb will upload files to FortiSandbox and wait for scan results before sending the file to the server. This process may take some time, please check if the server will disconnect while waiting.
FortiWeb parses files up to 5M by default, and if it exceeds 5M, the requests will be bypassed.
If you want to increase this value, please configure it as below.
config system antivirus
set uncomp-size-limit 102400
When a HTTP request is divided into multiple TCP packets, before the packet which includes the denied parameter appears, the previous TCP packets will still be transmitted to the server.