Controls the strictness of the matching logic required to associate a request with a tracking ID.

• enabled — FortiWeb requires a Full Match. A tracking ID is generated or updated only if every attribute defined in the policy is present. If even one attribute is missing, tracking is bypassed (regardless of the bypass-when-none-matched setting).

• disabled — FortiWeb allows a Partial Match. A tracking ID is generated if at least one attribute matches, or potentially even with zero matches depending on the bypass-when-none-matched setting.

Controls the exception logic for requests that fail to meet the tracking criteria.

• enabled — If a request contains none of the attributes specified in the policy, FortiWeb skips the ID creation process entirely for that request. This prevents the tracking table from being filled with "empty" or anonymous entries that provide no useful metadata.

• disabled — FortiWeb generates a tracking ID even if zero attributes are detected. When combined with track-only-when-all-matched disable, this creates a "catch-all" tracking state where every request is assigned an ID. This ensures that every request is assigned an ID, ensuring every client is indexed even without identifiable fingerprints beyond the connection itself.

Select the HTTP attribute to extract. FortiWeb normalizes these in a fixed sequence to ensure hash stability:

Source IP > URL Path > Request URL Parameter > Request Cookie > Request Header > Request Body > Response Header > Response Code

• source-ip (Source IP) — Uses the client IP address to help identify the requester. Can appear only once. No name or pattern required.

• url (URL Path) — Matches or extracts portions of the request path. Supports plain or regex matching. Regex cannot be empty.

• request-url-parameter (Request URL Parameter) — Extracts a value from the query string. Requires a non-empty parameter name. Name cannot be reused. Supports plain or regex.

• request-body-parameter (Request Body) — Extracts a value from the request body. Requires a non-empty parameter name. Name cannot be reused. Supports plain or regex.

• request-cookie (Request Cookie) — Uses a cookie value supplied by the application. Requires a non-empty cookie name. Name cannot be reused. Supports plain or regex.

• request-header (Request Header) — Uses a request header such as X-User-ID or Authorization. Requires a non-empty header name. Name cannot be reused. Supports plain or regex.

• response-header (Response Header) — Extracts a value from response headers. Requires a non-empty header name. Supports plain or regex.

• response-code (Response Code) — Matches the HTTP response status returned to the client. Can appear only once. Requires a min and max code range. No regex or name.

Note: You cannot create multiple conditions within one policy for source-ip, response-code, or url when its target-value-type is plain.

target-name <string>

Specify the attribute name (e.g., cookie or header name). This is required for all targets except source-ip, response-code, and url when its target-value-type is plain.

Note: You cannot reuse the same target-name for the same match-target within one policy.

target-value-type {plain|regular}

Specify the target value type:

• plain — Use the attribute value exactly as the key.

• regular — Use a regular expression to extract a specific portion of the value.

target-value-regex <string>

Enter the regular expression for value extraction. This cannot be empty if target-value-type is set to regular.

response-code-min <integer>

The minimum HTTP status code in a range.