How do I handle oversize HTTP requests in AWS WAF?

Short description

When a web request body exceeds the body inspection size limit, the underlying host service forwards only contents that are within the limit to AWS WAF. AWS WAF doesn't detect cross-site scripting (XSS) attacks or SQL injection patterns in the web request body beyond the limit.

Note: AWS WAF doesn't log contents of the web request body whether or not it finds an attack pattern within the body inspection size limit.

To protect against attack patterns that don't appear within the body inspection size limit for oversize requests, configure a rule that blocks all oversize requests. Then, create a rule that explicitly allows legitimate oversize requests. You can either create a custom rule, or use the core rule set (CRS) managed rule group.

Resolution

Use a CRS managed rule

To use the CRS managed rule group, turn on the SizeRestrictions_Body rule to block requests that exceed 8 KB (8,192 bytes). Then, create a rule that allows legitimate requests that exceed the size limit.

Turn on the SizeRestrictions_Body rule

Complete the following steps:

1. Open the AWS WAF console.
2. For Region, choose the AWS region where you created your protection pack.
   Note: If your web ACL is set up for Amazon CloudFront, then select Global.
3. In the navigation pane, choose Resources & protection packs.
4. On the right side of protection pack, select the icon next to region name to choose the protection pack.
5. In your selected protection pack, select Rules.
6. Select View and edit next to Rules to view or modify the rules associated with your protection pack.
7. In the right pane for Manage rules choose Add rules.
8. Choose AWS-managed rule group and select Next.
9. Under Free rules, select Core rule set.
10. To inspect and block web request bodies that exceed 8 KB, set the SizeRestrictions_BODY rule to Block.
11. Select Create Rule.

To reduce the occurrence of false positives, use only the SizeRestrictions_Body rule and override all other rules to Count.

Create a rule that allows legitimate requests

The SizeRestrictions_Body rule might block legitimate requests that exceed 8 KB. To allow legitimate requests that exceed the size limit, set the SizeRestrictions_BODY rule to Count. Then, use the labels that AWS WAF adds for subsequent rule evaluation. 

Complete the following steps:

1. Open the AWS WAF console.
2. For Region, choose the AWS region where you created your protection pack.
   Note: If your web ACL is set up for Amazon CloudFront, then select Global.
3. In the navigation pane, choose Resources & protection packs.
4. On the right side of protection pack, select the icon next to region name to choose the protection pack.
5. In your selected protection pack, select Rules.
6. Select View and edit next to Rules to view or modify the rules associated with your protection pack.
7. Choose AWSManagedRulesCommonRuleSet.
8. For SizeRestrictions_BODY rule, choose Override to Count.
9. Save rule.
10. Choose Add rule.
11. Choose Custom rule and select Next.
12. Choose Custom rule again and select Next.
13. To set up your rule, configure the following values:
    For Action, choose Block.
    For Name, enter a rule name.
    For If a request, choose matches all the statements (AND)
    For Statement 1, enter the following information:
    For Inspect, choose Has a label.
    For Match scope, choose Label.
    For Match key, enter the label awswaf:managed:aws:core-rule-set:SizeRestrictions_Body.
    For Statement 2, enter the following information:
    Choose Negate statement results.
    For Inspect, choose URI path.
    For Match type, choose Exactly matches string.
    For String to match, enter /upload.
    Note: Replace /upload with your URI path where you make requests.
14. (Optional) For text transformation, choose a text transformation, or choose None.
15. Choose Create rule.
16. For Set rule priority, choose Edit rule order. Move the rule to a position after the CRS managed rule group.
    Note: The SizeRestrictions_Body rule in the CRS can now add a label, and AWS WAF can use the label in subsequent rules.
17. Choose Save rule order.

Note: It's a best practice to test rules in a non-production environment with Action set to Count. To evaluate the rule, use Amazon CloudWatch metrics with AWS WAF sampled requests or AWS WAF logs.

Create a custom body inspection rule

Set up the oversize request handling action for the rule

When you configure a custom body inspection rule, you can choose the oversize request handling action. Oversize handling tells AWS WAF what to do with a web request when the request body exceeds the size limit. The options to handle oversize components include Continue, Match, and No match. On the AWS WAF console, you must choose one of these options. Outside the console, the default option is set to Continue. To block oversize requests, create a custom rule that uses the oversize request handling action.

Create a rule that allows legitimate requests

To allow legitimate requests that exceed the size limit, create a rule that explicitly allows requests from legitimate hosts. Then, update the rule's priority so that it's higher than the priority of the rule that blocks the request.

Related information

Why does AWS WAF block my legitimate upload request?