How to edit 403 error message in AWS WAF
is there a way to customize the 403 error message that WAF puts out? Right now our clients are seeing:
<html> <head><title>403 Forbidden</title></head> <body> <center><h1>403 Forbidden</h1></center> </body> </html>Is there way to edit this? So that clients aren't seeing html tags etc if they receive a 403 error trying to log into our app? The WAF rule that is triggering this is the AWS-AWSManagedRulesBotControlRuleSet...being that it is a managed rule I can't edit the JSON to put out a different output (is this just a console limitation?). And I tried using the custom response bodies section on the rule but it isn't what I need. I just want to change the above out to say something like: "403 Forbidden" but I don't want clients to be seeing <html> <head> etc on the app...like I'm not sure if I can use the terminal to edit this? I attached a picture so you can see what the error message looks like...it just looks really unprofessional imo.
- Newest
- Most votes
- Most comments
Hi,
Yes, there is such a capability announced in 2021: https://aws.amazon.com/about-aws/whats-new/2021/03/aws-waf-adds-support-custom-responses/
See for details to implement: https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html
Best,
Didier
Relevant content
- asked 5 years ago
- asked 4 months ago
AWS OFFICIALUpdated a year ago- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated a year ago
So would I need to create a new rule from scratch? Or I could implement this with an AWS managed rule?
it you open the first URL Didier sent you will see "You can get started with the Custom Response feature by configuring the action associated with any new or existing WAF rule, or the default action associated with your web ACL." so you can create a new rule or use the exisiting one
so if I follow these instructions (as illustrated in this video:https://www.youtube.com/watch?v=Cd9c-y3v4y4) this isn't going to work for me because I can't edit a managed rule for AWS
checking through this https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html i believe this is exactly what you need
could I zoom you and show you what im talking about?