From the Type list, select to base the match evaluation on the substring or

4-16 Oracle Fusion Middleware Administrators Guide for Oracle Web Cache To configure rules for the format request filter: 1. Navigate to the Web Cache Home page in Fusion Middleware Control. See Section 2.6.2 .

2. From the Web Cache menu, select Administration and then Request Filters.

The Request Filters Summary page displays.

3. From the Site list, select the site to apply the filter. See

Section 2.11.3 and Section 2.11.4 to create additional sites. You can configure filters and filter rules for specific sites or Undefined Sites. Oracle Web Cache directs client requests that do not match a defined site to the request filters configured for Undefined Sites.

4. Click the Query String link.

The Query String Request Filter page displays.

5. From the Audit list, select the level of action for Oracle Web Cache to include in its

audit log for the request filter.

6. From the Response to deny list, select the HTTP response for Oracle Web Cache to

return to browsers for requests that are denied by this request filter. The Close Connection option does not return any HTTP responses. It just closes the connection. 7. Define a rule for the validation type:

a. Click the Enable check box to enable the validation check:

- Null Byte: This validation checks for encoding as a null byte as 00. Most applications do not expect null bytes in the URL. This may cause a string which contains tricks after a null byte to pass an application check because the application stops checking when it hits the null byte, thinking that it is the end of string marker. - Valid Unicode: This validation checks for Unicode characters, either encoded or raw in the URL for an application that is not set up to handle Unicode. - Strict Encoding: This validation checks for unencoded characters, such as a space, backslash \, or non-printable characters. - Double Encoding: This validation checks for XY sequences using XY encoding, in an attempt to get the XY sequence to be passed to the application. This could allow the hacker to specify a character that would otherwise be rejected. - Uencoded Unicode Characters: This validation checks for Unicode characters, either encoded or raw in the URL for an application that is not set up to handle Unicode.

b. Click the Check Query String check box to verify the format of the URL, as

well as the query string or request body for a POST request; leave this option unchecked to verify only the format of the URL.

c. Click the Allow check box for Oracle Web Cache to allow requests containing

the invalid format; deselect the check box for Oracle Web Cache to deny requests containing the invalid format.

d. Click the Monitor Only check box to see the match activity of the rule without

enforcing the rule. Configuring Request Filtering 4-17 When results are expected, then disable Monitor Only to enforce the rule. See Section 4.4 for further information about the Monitor Only option.

e. Click Apply to save the rule settings.

8. Click the Request Filters Summary breadcrumb at the top of the page, or from the

Web Cache menu, select Administration and then Request Filters to navigate back to the Request Filters Summary page.

9. In the Format row, click Enable to enable the filter.

If you do not click Enable, Oracle Web Cache ignores any configured filter rules for this filter.

10. Click Apply to save the configuration for the request filter.

4.12 Deleting Rules for a Request Filter

To delete a rule for a request filter: 1. Navigate to the Web Cache Home page in Fusion Middleware Control. See Section 2.6.2 .

2. From the Web Cache menu, select Administration and then Request Filters.

The Request Filters Summary page displays. 3. Click the filter you want to modify.

4. From the Site list, select the site.

5. Select a rule in the table and click the Delete icon.

6. Repeat Step 5 for each additional rule you want to remove.

7. Click Apply to save the configuration for the request filter.

4.13 Monitoring Statistics for Request Filter Types and Rules

Fusion Middleware Control provides statistics for assessing the effectiveness of configured request filters and rules. By analyzing the rules, you can determine if you prioritized the rules incorrectly. For example, if the you notice a deny rule is matched but configured allow rules are never matched, then prioritize the allow rules first. If you make changes to the configuration settings for Oracle Web Cache, Oracle Web Cache disables the request-filter statistics and labels them as NA. To view request-filter statistics: 1. Navigate to the Web Cache Home page in Fusion Middleware Control. See Section 2.6.2 .

2. From the Web Cache menu, select Administration and then Request Filters.

The Request Filters Summary page displays.

3. Scroll to the far right, to view the Request Statistics and Post Allow Statistics.

The Request Statistics display the run time statistics for tracking how the configured request filters handle the incoming requests: ■ Matched Catch All: Displays the number of requests that matched the Catch All rules. ■ Matched Others: Displays the number of requests that matched the rules that were not Catch All requests.