OWASP WAF rules reject application/vnd.api+json

maahrens · July 20, 2023, 8:36am

I run into an issue where json:api requests are blocked by Web Application Firewall. The implemented rules come from OWASP project and here, application/vnd.api+json is not on the content-type default allow list.

github.com

coreruleset/coreruleset/blob/v4.0/main/crs-setup.conf.example#L435


      
          #          MERGE MKACTIVITY MKCOL MOVE PROPFIND PROPPATCH PUT UNLOCK
          # Uncomment this rule to change the default.
          #SecAction \
          # "id:900200,\
          #  phase:1,\
          #  nolog,\
          #  pass,\
          #  t:none,\
          #  setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"
          
          # Content-Types that a client is allowed to send in a request.
          # Default: |application/x-www-form-urlencoded| |multipart/form-data| |multipart/related|
          # |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json|
          # |application/cloudevents+json| |application/cloudevents-batch+json| |application/octet-stream|
          # |application/csp-report| |application/xss-auditor-report| |text/plain|
          # Uncomment this rule to change the default.
          #
          # Please note, that the rule where CRS uses this variable (920420) evaluates it with operator
          # `@within`, which is case sensitive, but uses t:lowercase. You must add your whole custom
          # Content-Type with lowercase.
          #

Why is json:api not just sticking with plain application/json?
Does it make sense to propose adding application/vnd.api+json as default on the OWASP WAF rules project?

Many parties in implement those rules these days and it is painful to always start a discussion why the holy defaults must be overwritten.

Topic		Replies	Views
Content-Type / Accept header error responses	6	10886	March 3, 2020
Content-type requirements has vague wording	1	1373	April 4, 2017
JSON API content type makes exploring in the browser impossible	2	2963	May 20, 2016
File uploading with multipart	6	24666	September 28, 2016
Server response when Content-Type is not present	2	914	March 24, 2021

OWASP WAF rules reject application/vnd.api+json

Related topics