WAF body limit rule
Hi team,
I was following the instructions in this article: AWS WAF Oversize Request Components to add a rule in our WAF to block request bodies over 20MB.
The WAF is attached to my CloudFront distribution, and the rule is intended to prevent clients from uploading files larger than 20MB. However, after adding the rule, I uploaded a 950KB file, and it was unexpectedly blocked by the WAF rule, which is supposed to block files greater than 20MB.
Do you have any idea why this might be happening?
- Newest
- Most votes
- Most comments
Can you share the full details of the rule that you have created? It's not clear exactly what your rule above is doing, but, as per the previous comment, it doesn't look like you are inspecting for the actual size of the request.
answered 2 years ago
Are you using Core rule set (CRS) managed rule group?
SizeRestrictions_BODY blocks large file upload
The article How do I explicitly allow file uploads that an AWS WAF rule blocks without excluding the rule? may help
You can try to use the size constraint match rule which looks at the specific parts of the request instead of the whole request.
The "Oversize Request Body" size check looks at the entire request body, including any headers or other metadata, not just the file size itself. The "size constraint" looks at specific parts of the request.
answered 2 years ago
not quite sure what is the difference between what you are suggesting and the WAF rule i have in the screenshot above
what's wrong there?
Relevant content
asked 4 years ago
asked 3 years ago
- AWS OFFICIALUpdated a year ago
i updated the question to add rule detail
I see. In the document that you linked in your questions, you'll note that it mentions: "For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, by default, AWS WAF can inspect the first 16 KB, and you can increase the limit up to 64 KB in your web ACL configuration." So your rule to look for JSON body content larger than 20Mb is not going to work. Reference the Size match statement section here: https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-size-constraint-match.html That aside, the reason the request is getting blocked is because you have set you set the "Oversize Handling" to Match, which means that it will treat your 950KB request as matching the rule and will take the set action, which is "Block".
In general, rules to prevent uploads of large files are better implemented on the client side. Failing that, you could look at creating an edge function within CloudFront to do something similar: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/edge-functions.html