4

I am trying to use AWS WAF to block requests with certain URL patterns. I am using the string matching filter, but it is not blocking the requests. I must be doing it incorrectly.

Here is what I am trying to block: https://xxx.domain.com/

A good url would be: https://xxx.domain.com/something/something

The URL with nothing after the .com slash is never used in this example and is only hit by malicious traffic.

How do I use WAF to block these requests?

Pete Lunenfeld
  • 1,557
  • 3
  • 19
  • 32

2 Answers2

0
  1. You can configure rules based on Referrer or Origin
  2. Use regex based rule example *.domain.com
  3. Take action to Block
PCB
  • 638
  • 1
  • 11
  • 22
0

I had to solve the same issue and did it in the following way:

Create a custom rule, which blocks on complete string equality, and setting the match string to /.

This blocks all requests to the base domain url (www.example.com).

dingo
  • 443
  • 3
  • 16