After you add your web services to Web Application Firewall (WAF), you can configure protection rules for the custom response module to configure custom block pages that you want to return to clients when the requests of the clients are blocked. You can specify a custom status code, response header, and response body. By default, the custom response module is disabled. This topic describes how to configure protection rules for the custom response module.
Background information
If you do not configure protection rules for the custom response module, a default block page is returned to clients when requests are blocked.
You can specify a custom status code, response header, and response body.
Prerequisites
A subscription WAF 3.0 instance that runs the Enterprise or Ultimate edition or a pay-as-you-go WAF 3.0 instance is purchased. For more information, see Purchase a subscription WAF 3.0 instance and Purchase a pay-as-you-go WAF 3.0 instance.
Web services are added to WAF 3.0 as protected objects. For more information, see Configure protected objects and protected object groups.
Create a protection template of the custom response module
The custom response module does not provide default protection templates. Before you can enable a protection rule of the custom response module, you must create a protection template of the module. After the template is created, a protection rule is automatically generated.
Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and the region in which the WAF instance is deployed. You can select Chinese Mainland or Outside Chinese Mainland for the region.
In the left-side navigation pane, choose .
In the Custom Response section of the Basic Web Protection page, click Create Template.
NoteIf this is your first time to create a protection template of the custom response module, you can also click Configure Now in the Custom Response card in the upper part of the Basic Web Protection page.
In the Create Template - Custom Response panel, configure the parameters and click OK. The following table describes the parameters.
Parameter
Description
Template Name
Specify a name for the template.
The name of the template must be 1 to 255 characters in length and can contain letters, digits, periods (.), underscores (_), and hyphens (-).
Save as Default Template
Specify whether to set this template as the default template of the protection module.
You can set only one default template for a protection module. If you turn on Save as Default Template, you do not need to configure the Apply To parameter. The default template is applied to all protected objects and protected object groups to which no protection templates are applied.
Rule Configuration
Configure rule settings. A protection template of the custom response module contains only one protection rule.
Status Code
Specify the HTTP status code that is returned by WAF to the client when WAF blocks a request. Valid values: 200 to 600. Default value: 405.
Custom Header
Specify the header field in the response that is returned by WAF to the client when WAF blocks a request. Each header field consists of Header Name and Header Value. You can add up to five header fields.
Response Body
Specify the source code of the block page. Make sure that the following requirements are met:
The response body is in the HTML or JSON format.
You can configure the Custom Header parameter to add the
content-typeheader field to specify the format of the response body.The response body can contain up to 4,000 characters.
ImportantIf you want to retain request IDs on the block page, reference the
{::trace_id::}string. You can use the request IDs to query blocked requests in logs.
Apply To
Select the protected objects and protected object groups to which you want to apply the template.
You can apply only one template of a protection module to a protected object or a protected object group. For information about how to associate protected objects and protected object groups with the template, see Configure protected objects and protected object groups.
By default, a new rule template is enabled. You can perform the following operations in the rule template list:
View the number of protected objects and protected object groups that are associated with the template.
Turn on or turn off the switch in the Status column to enable or disable the template.
Click Edit or Delete in the Actions column to modify or delete the template.
Click the
icon to the left of a template name to view the rules in the template.
After the protection template takes effect, the default block page for the protected objects to which the protection template is applied is replaced by the custom block page that you specify in the Rule Configuration section. If you want WAF to return the default block page to clients, disable or delete the protection template.
References
For more information about the protection objects, protection modules, and protection process of WAF 3.0, see Protection configuration overview.
For more information about how to create a protection template by calling an API operation, see CreateDefenseTemplate.
For more information about how to create a protection rule by calling an API operation, see CreateDefenseRule.