Forum Discussion

SKYNET_317203's avatar
SKYNET_317203
Icon for Nimbostratus rankNimbostratus
Aug 20, 2018
Solved

ASM Attack Signature to block method on specific uri

I know you can do somethign similar to what I'm trying to do with an iRule, however I'm wondering if this can be done with a custom attack signature. I've gone ahead and created the following:

uricontent:"/some/path/here"; nocase; objonly;
headercontent:"OPTIONS"; nocase;

However, when I test sending an options method, it still allows it. I've made sure the signature is attached to the policy in blocking mode and is not in staging. Any idea why this would not be blocking requests?

  • Ironically the answer is no, the only way to do this is with an iRule triggering a custom violation.