For Affinity, you can select one of three options. None results in load For Load Weight, either enter a percentage of the load to be handled by the

4 Configuring Request Filtering 4-1 4 Configuring Request Filtering This chapter introduces the request filters provided by Oracle Web Cache and explains how you can enable them to protect against common HTTP request attacks. This chapter includes the following topics: ■ Section 4.1, Introduction to Request Filtering ■ Section 4.2, Types of Request Filters ■ Section 4.3, About Learned Rules ■ Section 4.4, About the Monitor Only Mode ■ Section 4.5, Configuring Rules for the Privileged IP Filter ■ Section 4.6, Configuring Rules for the Client IP Request Filter ■ Section 4.7, Configuring Rules for the Method Request Filter ■ Section 4.8, Configuring Rules for the URL Request Filter ■ Section 4.9, Configuring Rules for the Header Request Filter ■ Section 4.10, Configuring Rules for the Query String Request Filter ■ Section 4.11, Configuring Rules for the Format Request Filter ■ Section 4.12, Deleting Rules for a Request Filter ■ Section 4.13, Monitoring Statistics for Request Filter Types and Rules ■ Section 4.14, Reducing Time to Configure Request Filters

4.1 Introduction to Request Filtering

Oracle Web Cache provides request filters to filter incoming HTTP or HTTPS requests to configured sites on the origin server. Request filtering aids administrators in controlling access to Web sites: ■ The planting of malicious code within the Web site that, when executed by a user, steals the users identity or personal information ■ Attacks that try to exploit software vulnerabilities in the site that enable the attacker to execute arbitrary code on the application server. ■ Attacks that try to render a Web site unusable by bombarding it with extremely high volumes of bogus requests that effectively consume the application server resources or bandwidth thereby preventing access for other users. 4-2 Oracle Fusion Middleware Administrators Guide for Oracle Web Cache In addition, request filtering controls which clients and requests are allowed to access to a Web site or certain parts of a Web site. To defend against Web site attacks, you can enable a series of filters that each request must pass through before being processed. Each filter is composed of customizable rules that can either identify the requests to allow or deny. You can configure filters and filter rules for specific sites or undefined sites. Oracle Web Cache directs client requests that do not match a defined site to the request filters configured for Undefined Sites. The requests filters are processed in the order presented in the Request Filter Summary page. To access this page: 1. Navigate to the Web Cache Home page in Fusion Middleware Control. See Section 2.6.2 .

2. From the Web Cache menu, select Administration and then Request Filters.

The Request Filters Summary page displays. You select an individual filter from the Filter column, and specify individual rules for the filter. When configuring rules, you order the rules based on the order you want Oracle Web Cache to match requests. When ordering caching rules, give allow rules a higher priority than deny rules. After configuring rules for a filter and enabling or disabling the rules, you return to the Request Filters Summary page to enable the filters. If you do not click Enable for a filter, then you are disabling the rule, which means Oracle Web Cache ignores any configured rules for that filter.

4.2 Types of Request Filters

Oracle Web Cache provides the following filters, each designed to focus on a particular type of HTTP request vulnerability. ■ Privileged IP ■ Client IP ■ Method ■ URL ■ Header Configuring Request Filtering 4-3 ■ Query String ■ Format The privileged IP filter permits allow-only rule; the header, query string, and format filters permit deny-only rules; and the client IP, method, and URL filters permit both allow and deny rules. Because the list of rules in the header, query string, and format filters are independent of each other, permitting allow rules could result in the skipping of other deny rules. Therefore, these filters only permit deny rules. Privileged IP The privileged IP filter enables Oracle Web Cache to bypass the other request filters. You use this filter to allow specified privileged IP addresses access. Client IP The client IP filter allows or denies site access to specific IP addresses. It enables Oracle Web Cache to restrict access to a site URL prefix within the site to only certain IP addresses. This filter restricts clients from certain IP addresses from launching attacks on a system. Not restricting access could allow clients access to the application or to areas of the site that contain sensitive information. An attacker from a certain IP address can continue making malicious attacks if Oracle Web Cache does not deny access. You can configure a black list by denying requests if the IP address and URL match or a white list if the IP address and URL match. Method The method filter allows or denies site access based on the HTTP request method. For example, if only GET and POST methods are allowed, Oracle Web Cache would refuse all other requests. This filter protects against clients attempting to read restricted files or modifying files using various HTTP methods. In addition to the HTTP request method, you can configure a URL to limit the rule to only requests that match the method and the specified URL. URL The URL filter allows or denies site access based on a URL. This filter protects against Internet attacks to an application server through a specific URL. Header The header filter denies site access based on HTTP header values. In addition to the HTTP header value, you can configure a URL to limit the rule to only requests that match the header value and the specified URL. Incoming requests matching the HTTP header and URL are compared to the expression in the rule. The expression can be either a substring or a regular expression. For both substring and regular expression comparisons, a rule can deny requests in which the requests header value matches the rules value expression. This filter protects against clients attempting to break into an application by manually creating header values and clients submitting unwanted content in header values.