Skip to content

Commit 630f9ea

Browse files
dkleinF5dkleinF5
committed
removed 4th level header
1 parent a64a7cb commit 630f9ea

File tree

1 file changed

+117
-123
lines changed

1 file changed

+117
-123
lines changed

‎content/waf/configure/nginx-features.md‎

Lines changed: 117 additions & 123 deletions
Original file line numberDiff line numberDiff line change
@@ -28,114 +28,12 @@ F5 WAF for NGINX inspects direct client-facing requests, but does not inspect in
2828

2929
Examples of subrequest-based modules:
3030

31-
* njs
32-
* Client authorization
3331
* Slice
32+
* Client authorization
3433
* Mirror
34+
* njs
3535

36-
### Example
37-
38-
{{< tabs name="subrequest-example" >}}
39-
40-
{{% tab name="nginx.conf" %}}
41-
42-
```nginx
43-
user nginx;
44-
worker_processes auto;
45-
46-
events {
47-
worker_connections 1024;
48-
}
49-
50-
load_module modules/ngx_http_app_protect_module.so;
51-
load_module modules/ngx_http_js_module.so;
52-
53-
http {
54-
include /etc/nginx/mime.types;
55-
default_type application/octet-stream;
56-
sendfile on;
57-
keepalive_timeout 65;
58-
js_import main from example.js;
59-
60-
server {
61-
listen 80;
62-
server_name localhost;
63-
proxy_http_version 1.1;
64-
app_protect_enable on;
65-
66-
location / {
67-
proxy_pass http://127.0.0.1:8080/foo/$request_uri;
68-
}
69-
}
70-
server {
71-
listen 127.0.0.1:8080;
72-
server_name localhost;
73-
proxy_http_version 1.1;
74-
75-
location /foo {
76-
js_content main.fetch_subrequest;
77-
}
78-
79-
location / {
80-
internal;
81-
return 200 "Hello! I got your URI request - $request_uri\n";
82-
}
83-
}
84-
}
85-
```
86-
87-
{{% /tab %}}
88-
89-
{{% tab name="example.js" %}}
90-
91-
```js
92-
async function fetch_subrequest(r) {
93-
let reply = await r.subrequest('/<script>');
94-
let response = {
95-
uri: reply.uri,
96-
code: reply.status,
97-
body: reply.responseText,
98-
};
99-
r.return(200, JSON.stringify(response));
100-
}
101-
102-
export default {join};
103-
```
104-
105-
{{% /tab %}}
106-
107-
{{< /tabs >}}
108-
109-
If the njs handler triggers an internal subrequest to `/<script>`, it is not inspected by F5 WAF for NGINX and succeeds:
110-
111-
```shell
112-
curl "localhost/"
113-
```
114-
115-
```text
116-
{"uri":"/<script>","code":200,"body":"Hello! I got your URI request - /foo//\n"}
117-
118-
```
119-
120-
However, if a direct, client-facing request attempts to trigger the same URL, it is inspected by F5 WAF for NGINX and is blocked according to the security policy.
121-
122-
```shell
123-
curl "localhost/<script>"
124-
```
125-
126-
```text
127-
<html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your administrator.
128-
129-
Your support ID is: 123456789
130-
131-
<a href='javascript:history.back();'>[Go Back]</a></body></html>
132-
```
133-
134-
### Additional subrequest-based examples
135-
136-
These examples show other subrequest-based modules. In each case, internal subrequests are not inspected by WAF.
137-
138-
#### Slice
36+
### Slice module example
13937

14038
```nginx
14139
load_module modules/ngx_http_app_protect_module.so;
@@ -164,7 +62,7 @@ http {
16462
}
16563
```
16664

167-
#### Mirror
65+
### Mirror module example
16866

16967
```nginx
17068
load_module modules/ngx_http_app_protect_module.so;
@@ -189,7 +87,38 @@ http {
18987
}
19088
```
19189

192-
#### njs
90+
### Client authorization module example
91+
92+
```nginx
93+
load_module modules/ngx_http_app_protect_module.so;
94+
95+
http {
96+
server {
97+
listen 127.0.0.1:8080;
98+
server_name localhost;
99+
100+
location / {
101+
auth_request /scan;
102+
proxy_pass http://localhost:8888;
103+
}
104+
location /scan {
105+
proxy_pass http://localhost:8081$request_uri;
106+
}
107+
}
108+
109+
server {
110+
listen 127.0.0.1:8081;
111+
server_name localhost;
112+
113+
location /scan {
114+
app_protect_enable on;
115+
proxy_pass http://localhost:8888;
116+
}
117+
}
118+
}
119+
```
120+
121+
### njs module example
193122

194123
```nginx
195124
load_module modules/ngx_http_app_protect_module.so;
@@ -219,37 +148,104 @@ http {
219148
}
220149
```
221150

222-
#### Client authorization
151+
### General example (njs subrequest-based module)
152+
153+
{{< tabs name="subrequest-example" >}}
154+
155+
{{% tab name="nginx.conf" %}}
223156

224157
```nginx
158+
user nginx;
159+
worker_processes auto;
160+
161+
events {
162+
worker_connections 1024;
163+
}
164+
225165
load_module modules/ngx_http_app_protect_module.so;
166+
load_module modules/ngx_http_js_module.so;
226167
227168
http {
169+
include /etc/nginx/mime.types;
170+
default_type application/octet-stream;
171+
sendfile on;
172+
keepalive_timeout 65;
173+
js_import main from example.js;
174+
228175
server {
229-
listen 127.0.0.1:8080;
176+
listen 80;
230177
server_name localhost;
178+
proxy_http_version 1.1;
179+
app_protect_enable on;
231180
232181
location / {
233-
auth_request /scan;
234-
proxy_pass http://localhost:8888;
182+
proxy_pass http://127.0.0.1:8080/foo/$request_uri;
235183
}
236-
location /scan {
237-
proxy_pass http://localhost:8081$request_uri;
238-
}
239184
}
240-
241185
server {
242-
listen 127.0.0.1:8081;
186+
listen 127.0.0.1:8080;
243187
server_name localhost;
188+
proxy_http_version 1.1;
244189
245-
location /scan {
246-
app_protect_enable on;
247-
proxy_pass http://localhost:8888;
190+
location /foo {
191+
js_content main.fetch_subrequest;
192+
}
193+
194+
location / {
195+
internal;
196+
return 200 "Hello! I got your URI request - $request_uri\n";
248197
}
249198
}
250199
}
251200
```
252201

202+
{{% /tab %}}
203+
204+
{{% tab name="example.js" %}}
205+
206+
```js
207+
async function fetch_subrequest(r) {
208+
let reply = await r.subrequest('/<script>');
209+
let response = {
210+
uri: reply.uri,
211+
code: reply.status,
212+
body: reply.responseText,
213+
};
214+
r.return(200, JSON.stringify(response));
215+
}
216+
217+
export default {join};
218+
```
219+
220+
{{% /tab %}}
221+
222+
{{< /tabs >}}
223+
224+
If the njs handler triggers an internal subrequest to `/<script>`, it is not inspected by F5 WAF for NGINX and succeeds:
225+
226+
```shell
227+
curl "localhost/"
228+
```
229+
230+
```text
231+
{"uri":"/<script>","code":200,"body":"Hello! I got your URI request - /foo//\n"}
232+
233+
```
234+
235+
However, if a direct, client-facing request attempts to trigger the same URL, it is inspected by F5 WAF for NGINX and is blocked according to the security policy.
236+
237+
```shell
238+
curl "localhost/<script>"
239+
```
240+
241+
```text
242+
<html><head><title>Request Rejected</title></head><body>The requested URL was rejected. Please consult with your administrator.
243+
244+
Your support ID is: 123456789
245+
246+
<a href='javascript:history.back();'>[Go Back]</a></body></html>
247+
```
248+
253249
## Range header–dependent modules
254250

255251
Features that add or depend on the HTTP Range header are unsupported in the same scope as __app_protect_enable__ on. Place Range-dependent logic in a separate scope that does not enable F5 WAF for NGINX, and have the F5 WAF for NGINX enable frontend proxy to that backend.
@@ -259,9 +255,7 @@ Examples of Range-dependent features:
259255
- Static location
260256
- Range
261257

262-
### Additional range-based examples
263-
264-
#### Static location
258+
### Static location example
265259

266260
```nginx
267261
load_module modules/ngx_http_app_protect_module.so;
@@ -284,7 +278,7 @@ http {
284278
}
285279
```
286280

287-
#### Range
281+
### Range example
288282

289283
```nginx
290284
load_module modules/ngx_http_app_protect_module.so;

0 commit comments

Comments
 (0)