Web Application Firewall:Examples of using the scenario-specific configuration feature

After you click the Sign In button on the Alibaba Cloud official website, a logon request is sent, which uses the following header fields.

The following figure shows the Scenario-specific Configuration page.You can configure an anti-crawler rule for the logon page based on the following description:

• If you click the button on the Alibaba Cloud official website, a logon request is sent. In this example, you must configure an anti-crawler rule to protect the logon page. Therefore, set the Scenario parameter to Logon.
• Set the Service Type parameter to Websites because the logon request is sent by a browser.
• The Sign In button is on the account.alibabacloud.com page. However, the logon request is sent to the passport.alibabacloud.com page. In this case, an intermediate domain name is used. Therefore, select Use Intermediate Domain Name and the account.alibaba.com domain name from the drop-down list. The anti-crawler rule is actually configured for the passport.alibabacloud.com domain name.
• The logon request includes /newlogin/login.do in the URL field and uses the POST method. You must add the required conditions for the Traffic Characteristics parameter.

The following figure shows the solution page at alibabacloud.com/solutions.

The following figure shows the Scenario-specific Configuration page.You can configure an anti-crawler rule for the solution page based on the following description:

• In this example, you must configure an anti-crawler rule to protect the subpages of alibabacloud.com/solutions. Therefore, set the Scenario parameter to solutions.
• Set the Service Type parameter to Websites because the solution page is visited by using a browser.
• If you want to visit a subpage of alibabacloud.com/solutions, a request whose URL is in the /solutions/xxx format is sent. Therefore, you must add the following conditions for the Traffic Characteristics parameter: URLPath Includes /solutions/ and Http-Method Equals GET. You do not need to select Use Intermediate Domain Name because no intermediate domain names are used. You can add more conditions by using other header fields, such as User-Agent, Params, and Referer.