Testing New Rule

Before deploying a new rule, you need to test it to make sure you don’t accidentally block legitimate requests.

In previous sections, you used Block and Allow when defining actions for evaluating requests. Additionally, you have another option which is Count. Count allows you to evaluate the number of requests that match your rule conditions.

Count is not a blocking action. When a request matches a rule with a Count action, the Web ACL will continue processing other rules.

Scenario

You have defined a new rule for your WAF. Before deploying it, you need to test it first. This is to reduce the risk of accidentally blocking legitimate requests.

The rule below will block requests with the username query parameter.

Testing New Rule

1. Create a new rule similar to Advanced Custom Rule in section 3.3.

• Access your Web ACL, select Manage Rule.
• Select Add rule.
• Select Custome rule, click Next.
• Scroll down, continue to select Custome rule, click Next

• Switch to JSON. In the JSON field, enter:

{
  "Name": "count-von-count",
  "Priority": 4,
  "Action": {
    "Count": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "count-von-count"
  },
  "Statement": {
    "SizeConstraintStatement": {
      "FieldToMatch": {
        "SingleQueryArgument": {
          "Name": "username"
        }
      },
      "ComparisonOperator": "GT",
      "Size": 0,
      "TextTransformations": [
        {
          "Type": "NONE",
          "Priority": 4
        }
      ]
    }
  }
}

• Then select Add rule

• Confirm the rule has been created successfully

2. Run the command.

curl "<Your Juice Shop URL>?username=admin"

3. Access S3 bucket

4. Select the bucket you created

5. Follow the path as shown in the S3 bucket, you will see a file that has recorded the request you just sent.