1回答
- 新しい順
- 投票が多い順
- コメントが多い順
1
Hi, if possible, you may want your partner to add a custom header or a query string parameter (what come after the ? in URL) that you agree upon in the request as per https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl-regex-conditions.html
Then, you filter on the presence of this header. This has some limitations as some hacker may fake the specific header of param that you add.
So, optimal solution is provided by the "Intelligent Threat API" but it's more demanding sincet his API needs to integrated in the application. See https://docs.aws.amazon.com/waf/latest/developerguide/waf-js-challenge-api.html
Your use case will dictate the amount of work that you want / can inject in your new WAF filtering
Best, Didier
Thank Didier for your answer,
Based on your command the custom is possible to set but it's related to the security lake if the hacker can fake the header param and Intelligent Threat API it's related to extra cost.