This message was deleted.

You should join the webinar I will host end of month. Even just enabling and having only log will make stuff blocked. The NS changes stuff with headers and RFC as soon as it enabled and bound

Link to the webinar @Mads Petersen ?

@Carl Behrent It was mostly a joke, but it's something I hear a lot.. We want AppFW and we turned it, shit broke.. So i will be doing a webinar about "AppFW - What now and what they don't tell you" but it will be in Danish, but i'm thinking about doing one in English at some point after.

sounds good, keen to hear that, the English one 🙂

Hi Mads, yes indeed but luckily I am testing on our test environments first. What really surprise me is turning on the logging for the security checks break new stuff. I knew for WAF turned on change headers, forms, ... but I didn't realise by enabling log for other security check also make other change so basically any change to WAF even logging should be tested very carefully making it a disaster and a big pain to roll out. Also what is very difficult is as stuff is not block you don't know what logging break your app. Time consuming working with the devs. And I couldn't find in the doc the info of what is being change based on what logging you enable.

Take a look at the RFC profile that is bound by default, it’s the blocking one, so now it will be strict with RFC, even if the security checks are in log. But the log should help you show why something is blocked.

Mads thanks for trying to help but I think we are not on the same page. I'll try to be clearer. 1. I already had the WAF enabled and bound, only in audit mode. All work well. 2. The only change I made was to tick the box Log for Cookie Consistency or Cookie Hijacking, print screen below. And it broke my web app. So I disabled and I know something with the cookie log break my app, what exactly I am not sure. 3. I have another one in the security check breaking something but there is nothing in the log as it's not a block, it is the insert of something into page, header, form that break my web app. And as there is no clear doc saying exactly what the log does per item (cookie Hijacking, etc), it make it hard. I hope I make sense. Thanks.

It's kinda hard to help with troubleshooting without access to the logs But still try to look at the RFC settings for the RFC Profile in your profile (It's under Profile settings) As you can see here, i've disabled the blocking of the DuplicateCookie, so it only logs it. Also in your Profile settings, try to enable the Verbose Log level to Pattern Payload Header

show appfw rfcprofile APPFW_RFC_BLOCK

1)      Name: APPFW_RFC_BLOCK

Comments: ""

InvalidGWTRPCReqsAction: block log stats

InvalidContentTypeHdrAction: block log stats

InvalidMultipartReqAction: block log stats

InvalidJsonReqAction: block log stats

DuplicateCookieNameValueAction: keepLast log stats