Selective WAF Bypass

HTTP:skip_waf()

Use this Lua script to instruct FortiWeb to bypass WAF module inspection based on HTTP request or response content. This is especially useful when specific URL patterns, headers, or body contents are known to be safe but would otherwise be flagged by WAF rules.

Function:

HTTP:skip_waf()

Supported Events:

• HTTP_REQUEST, HTTP_RESPONSE: Skips all WAF modules(except for layer3 session level checked WAF modules)

• HTTP_DATA_REQUEST, HTTP_DATA_RESPONSE (partial): Skips follow-up WAF modules if HTTP:collect(N) was used.

• HTTP_DATA_* (full body): Skips remaining modules after LUA_body module follow-up processing.

Example:

when HTTP_REQUEST {
    HTTP:collect(32)
}

when HTTP_DATA_REQUEST {
    local url = HTTP:url()
    if url and url:find("^/webaccess/") then
        local body = HTTP:body(0, 32)
        if body and body:find("^MUXV2 / HTTP/1.0") then
            HTTP:skip_waf()
            debug("Bypassing WAF for MUXV2 protocol\n")
        end
    end
}

Example: Bypass for Tunnel Initialization Requests

In some deployment scenarios (e.g., VMware BLAST protocol), specific HTTP requests should bypass WAF inspection to avoid false positives and performance degradation. The following script skips WAF processing for POST requests to the /ice/tunnel endpoint if they use chunked transfer encoding:

when HTTP_REQUEST {
    local method = HTTP:method()
    local uri = HTTP:url()
    local transfer_enc = HTTP:header("Transfer-Encoding")

    if method == "POST"
        and uri:find("^/ice/tunnel")
        and transfer_enc == "chunked" then
        HTTP:skip_waf()
        debug("Bypassing WAF for tunnel request: %s\n", uri)
    end
}

This logic helps prevent misclassification of tunneled traffic and ensures compatibility with applications using streaming protocols.