WAF pre-requisites:
For introducing WAF with Seclore, do ensure that the WAF requirements are as below.
- Maximum request body size value should not be below to 1.5 MB.
- Maximum file upload size value should not be below to 200 MB.
- HTTP request header size value should not be below to 16 KB.
- HTTP Session timeout value should be set above 15 mins.
- X-Forwarded-For request header should be supported.
- Web Socket protocol and promotion should be enabled/allowed in WAF.
- Web request to the Policy Server should not be blocked at WAF. If any request isgetting blocked, then we need to allow that request URL pattern after ensuring itis a false positive.
- All Online Viewer/Editor supported file formats should be allowed in WAF.
- Request cookies added by Seclore should not be modified/altered by WAF.
- Request URL for different platforms/OS should be allowed. LikeAndroid/IOS/Mac.
- If SSL content inspection is enabled on the Web Application Firewall, then validSSL certificate provided by a trusted CA is required on the WAF.
- GET, POST, OPTIONS, PUT and DELETE methods should be allowed on WAF.
Whitelisting of Seclore URLs:
- We recommend whitelisting all Seclore components URL. Sample as follows:
- Reason: Since the URLs are highly dynamic and influenced by factors such as user behavior, usage patterns, and deployment architecture, they may vary across environments. Hence, it is not feasible to define fixed or standard URLs.
Learning mode suggestion:
- To address this effectively, we suggest placing your WAF in learning or monitoring mode for a short duration for external users.
- This will allow it to capture real traffic, including dynamically generated parameters (such as session/authentication tokens, usernames, and file names), and help determine the appropriate maximum URL and header lengths based on your environment’s actual usage.
- Once these values are identified, WAF can be configured accordingly without impacting the production setup.