AWS WAFv2 determine header order

Hello HieuVu,

Well, the order your seeing is a interpret format of the request for log view (ie., For Reading purpose and Filtering purpose in CW or Athena).

Thus, at any point of time WAF only sees Key:Value (Ie., User-Agent:Mozilla/5.0...) header components NOT the order of the HTTP components.

https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields.html

Regards, CK

Hello HieuVu,

AWS WAF now supports Header Order match statement for request inspection

https://aws.amazon.com/tw/about-aws/whats-new/2023/06/aws-waf-header-order-match-statement-request-inspection/

AWS WAF separates the header names in the string using colons and no added spaces, for example

host:user-agent:accept:authorization:referer

In your use case, you can configure WAF rule like this:

host:user-agent with PositionalConstraint STARTS_WITH

Here is example WAF rule JSON

{
  "Name": "testheaderorder",
  "Priority": 0,
  "Action": {
    "Count": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "testheaderorder"
  },
  "Statement": {
    "ByteMatchStatement": {
      "FieldToMatch": {
        "HeaderOrder": {
          "OversizeHandling": "CONTINUE"
        }
      },
      "PositionalConstraint": "STARTS_WITH",
      "SearchString": "host:user-agent",
      "TextTransformations": [
        {
          "Type": "NONE",
          "Priority": 0
        }
      ]
    }
  }
}

To find more information regrading HeaderOrder , see:

HeaderOrder

https://docs.aws.amazon.com/waf/latest/APIReference/API_HeaderOrder.html

AWS Web Application Firewall (WAF): Header Order Match Statement | Amazon Web Services

https://www.youtube.com/watch?v=gZtGBhXlgIo