Protocol validation

The protocol validation policy group verifies the HTTP and HTTPS protocols used by clients to request content from your website's origin server. If the request meets the protocol-specific requirements, the transaction is allowed, while all non-compliant transactions are blocked.

ℹ️

Info

Bot Management, which includes this policy group, is available in the Pro and Enterprise plans. More details on the Security pricing page.

Configure protocol validation rules

You can review and configure protocol validation rules in the CDB Technical Web Portal:

1. Navigate to WAAP > Bot Management.

2. In the domain dropdown at the top of the page, select the needed domain.

3. The Bot Attacks tab contains the Service protocol validation and Prevent malformed request methods policies.

ℹ️

Service protocol validation is enabled by default. Prevent malformed request methods is disabled by default. To change the policy mode, click the Mode dropdown and select Protection or Disabled.

Service protocol validation

Block clients that try to interfere with the service's internal calls, such as tampering with cookies or request headers.

Prevent malformed request methods

Enforce HTTP RFC requirements that define how the client is supposed to interact with the server. If the requests don't meet the RFC standards, the client will be challenged with CAPTCHA or JavaScript validation. Clients that fail to pass the validation will be blocked.

The Policies endpoints manage Protocol Validation rules — blocking HTTP requests that violate protocol standards. Response examples include only the fields used in each step.

ℹ️

An API token is required, along with the ID of a WAAP-protected domain and the Python or Go SDK installed for SDK examples. Bot Management, which includes this policy group, is available on the Pro and Enterprise WAAP plans.

export GCORE_API_KEY="{YOUR_API_KEY}"
export WAAP_DOMAIN_ID="{YOUR_DOMAIN_ID}"

ℹ️

Protocol Validation policies are stored under the advanced-api-protection resource group. Filter rule sets by resource_slug value advanced-api-protection, then select Service protocol validation and Prevent malformed request methods by name.

View policy states

Retrieve the current mode of the Protocol Validation policies for a domain.

import gcore
import os

client = gcore.CDB()
domain_id = int(os.environ["WAAP_DOMAIN_ID"])

rule_sets = client.waap.domains.list_rule_sets(domain_id)
adv_set = next(
    rs for rs in rule_sets if rs.resource_slug == "advanced-api-protection"
)

protocol_names = {"Service protocol validation", "Prevent malformed request methods"}
rules = client.waap.domains.policies.list(domain_id, rule_set_id=adv_set.id)
for policy in rules:
    if policy.name in protocol_names:
        status = "enabled" if policy.mode else "disabled"
        print(f"{policy.name}: {status} ({policy.id})")

package main

import (
    "context"
    "fmt"
    "os"
    "strconv"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/waap"
)

func main() {
    client := gcore.NewClient()
    domainID, _ := strconv.ParseInt(os.Getenv("WAAP_DOMAIN_ID"), 10, 64)

    protocolNames := map[string]bool{"Service protocol validation": true, "Prevent malformed request methods": true}

    ruleSets := client.Waap.Domains.ListRuleSetsAutoPaging(context.Background(), domainID, waap.DomainListRuleSetsParams{})
    for ruleSets.Next() {
        rs := ruleSets.Current()
        if rs.ResourceSlug == "advanced-api-protection" {
            policies := client.Waap.Domains.Policies.ListAutoPaging(context.Background(), domainID, waap.DomainPolicyListParams{RuleSetID: gcore.Int(rs.ID)})
            for policies.Next() {
                policy := policies.Current()
                if protocolNames[policy.Name] {
                    status := "disabled"
                    if policy.Mode {
                        status = "enabled"
                    }
                    fmt.Printf("%s: %s (%s)\n", policy.Name, status, policy.ID)
                }
            }
        }
    }
}

curl -X GET "https://api.cdb-staging.cdn.orange.com/waap/v1/domains/${WAAP_DOMAIN_ID}/rule-sets" \
  -H "Authorization: APIKey ${GCORE_API_KEY}" \
  | jq '.[] | select(.resource_slug == "advanced-api-protection") | .rules[] | select(.name == "Service protocol validation" or .name == "Prevent malformed request methods") | {name, id, mode}'

The response includes each policy with its ID and current state. mode: true means enabled; mode: false means disabled.

Enable or disable a policy

Use the policy ID returned by the View policy states request.

Parameter	Required	Description
policy_id	Yes	ID of the policy to configure.
domain_id	Yes	ID of the WAAP-protected domain.
mode	Yes	true to enable the policy, false to disable it.

import gcore
import os

client = gcore.CDB()
domain_id = int(os.environ["WAAP_DOMAIN_ID"])

# Find the policy ID by name
rule_sets = client.waap.domains.list_rule_sets(domain_id)
adv_set = next(
    rs for rs in rule_sets if rs.resource_slug == "advanced-api-protection"
)
rules = client.waap.domains.policies.list(domain_id, rule_set_id=adv_set.id)
policy = next(r for r in rules if r.name == "Service protocol validation")

result = client.waap.domains.policies.update(policy.id, domain_id=domain_id, mode=True)
print(f"Service protocol validation is now {'enabled' if result.mode else 'disabled'}")

package main

import (
    "context"
    "fmt"
    "os"
    "strconv"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/waap"
)

func main() {
    client := gcore.NewClient()
    domainID, _ := strconv.ParseInt(os.Getenv("WAAP_DOMAIN_ID"), 10, 64)

    // Find the policy ID by name
    ruleSets := client.Waap.Domains.ListRuleSetsAutoPaging(context.Background(), domainID, waap.DomainListRuleSetsParams{})
    var policyID string
    for ruleSets.Next() {
        rs := ruleSets.Current()
        if rs.ResourceSlug == "advanced-api-protection" {
            policies := client.Waap.Domains.Policies.ListAutoPaging(context.Background(), domainID, waap.DomainPolicyListParams{RuleSetID: gcore.Int(rs.ID)})
            for policies.Next() {
                p := policies.Current()
                if p.Name == "Service protocol validation" {
                    policyID = p.ID
                }
            }
        }
    }

    result, _ := client.Waap.Domains.Policies.Update(context.Background(), policyID, waap.DomainPolicyUpdateParams{DomainID: domainID, WaapDomainPolicySettings: waap.WaapDomainPolicySettingsParam{Mode: true}})
    status := "disabled"
    if result.Mode {
        status = "enabled"
    }
    fmt.Printf("Service protocol validation is now %s\n", status)
}

# Set POLICY_ID to the id from the View policy states response
export POLICY_ID="{POLICY_ID}"

curl -X PATCH "https://api.cdb-staging.cdn.orange.com/waap/v1/domains/${WAAP_DOMAIN_ID}/policies/${POLICY_ID}" \
  -H "Authorization: APIKey ${GCORE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"mode": true}'

The API returns the updated policy object. mode: true confirms the policy is now enabled; mode: false confirms disabled.

Policy reference