waf graphql-validation rule

"<graphql_rule_name>"

Enter a name that can be referenced by other parts of the configuration. You will use the name to select the rule in a GraphQL protection policy.

Enable to compare the GraphQL rule to the Host: field in the HTTP header. If enabled, also configure host "<host_name_str>".

Enter the name of a protected host that the Host: field of an HTTP request must match in order for the rule to apply. For details, see server-policy allow-hosts.

request-type {plain | regular}

Select whether request-type {plain | regular} must contain either:

• plain—The field is a string that the request URL must match exactly.
• regular—The field is a regular expression that defines a set of matching URLs.

request-url <string>

Depending on your selection for request-type {plain | regular}, enter either:

• plain—The literal URL, such as /index.php, that the HTTP request must contain in order to match the rule. The URL must begin with a slash ( / ).
• regular—A regular expression, such as ^/*.php, matching the URLs to which the rule should apply. The pattern does not require a slash ( / ), but it must match URLs that begin with a slash, such as /index.cfm.

Do not include the domain name, such as www.example.com, which is configured separately in host "<host_name_str>".

action {alert | alert_deny | block-period | redirect | send_403_forbidden | deny_no_log}

Select one of the following actions that FortiWeb performs when a request violates the rule:

• alert—Accept the request and generate an alert email and/or log message.

• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.

  You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg.

• block-period—Block subsequent requests from the client for a number of seconds. Also configure block-period <period_int>.

• redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert email and/or log message.

• send_403_forbidden—Reply to the client with an HTTP 403 Access Forbidden error message and generate an alert email and/or log message.

• deny_no_log—Deny a request. Do not generate a log message.

Caution:FortiWeb ignores this setting when monitor-mode {enable | disable} is enabled.

Note: Logging and/or alert email will occur only if enabled and configured. For details, see log disk and log alertMail.

block-period <period_int>

Enter the amount of time (in seconds) that you want to block subsequent requests from a client after FortiWeb detects a rule violation. This setting is available only when action {alert | alert_deny | block-period | redirect | send_403_forbidden | deny_no_log} is block-period.

The valid range is 1–3,600 seconds.

severity {High Low | Medium | Info}

When rule violations are recorded in the attack log, each log message contains a Severity Level field. Select which severity level FortiWeb will use when it logs a violation of the rule:

• Low
• Medium
• High
• Info

trigger "<trigger_policy_name>"

Enter the name of the trigger, if any, to apply when the rule is violated. The maximum length is 63 characters. For details, see log trigger-policy.

To display a list of existing triggers, enter:

set trigger ?

enable-introspection {enable | disable}

Enable to allow introspection queries.

enable-fragment {enable | disable}

Enable to allow fragments.

graphql-data-size <integer>

It sets a limit on the size of the HTTP request body in the POST method or the size of URL parameters in the GET method.

field-number <integer>

It limits the number of terminal fields within a query, thereby limiting the number of fields within objects.

value-size <integer>

It sets a maximum length on any user input value within a GraphQL query.

• If the value is an array, each item in the array is evaluated against the specified value size.

• If the value is an object, only the values contained within the object are compared to the value size, not the keys themselves.

object-depth <integer>

It limits the depth of a GraphQL query, which limits how deeply nested the query can be.

alias-batch-query {enable | disable}

Enable this option to allow alias batching.

alias-batch-query-number <integer>

It sets a limit on the number of queries that can be found within an alias batch.

Only available when Alias Batching is enabled.

array-batch-query {enable | disable}

array-batch-query-number <integer>

It sets a limit on the number of queries that can be found within an array batch.

Only available when Array Batching is enabled.