SonicOS 7.1 Rules and Policies for Classic Mode

HTTP Post Control

You can enhance the security of public facing read-only HTTP servers by disallowing the HTTP POST method.

To disallow the HTTP POST

  1. Use Notepad or another text editor to create a new document called Post.htm that contains this HTML code:

    <FORM action="http://www.yahoo.com/" method="post">
    <p>Please enter your name: <input type="Text" name="FullName"></p>
    <input type="submit" value="Submit"> <INPUT type="reset">
  2. Save the file to your desktop or a convenient location.

  3. Open the Wireshark network analyzer and start a capture. For information about using Wireshark, see Wireshark.

  4. In a browser, open the Post.htm file you just created.

  5. Enter your name.

  6. Click Submit. Stop the capture.

  7. Use the Wireshark Edit > Find Packet function to search for the string POST.

    Wireshark jumps to the first frame that contains the requested data. You should see something like Wireshark Display. This indicates that the HTTP POST method is transmitted immediately after the TCP header information and comprises the first four bytes (504f5354) of the TCP payload (HTTP application layer). You can use that information to create a custom match object that detects the HTTP POST method.

    Wireshark Display

  8. In SonicOS, navigate to OBJECT | Match Objects > Custom Match.

  9. Click +Add.

  10. Create a custom match object like this:

    In this particular match object you would use the Enable Settings option to create an object that matches a specific part of the payload. The Offset field specifies which byte in the payload to begin matching and helps to minimize false positives by making the match more specific. The Depth field specifies at what byte to stop matching. The Min and Max fields allow you to specify a minimum and maximum payload size.

  11. Navigate to POLICY | Rules and Policies > App Rules.

  12. Click +Add Rule.

  13. Create a policy like this:

  14. To test, use a browser to open the Post.htm file you created earlier.

  15. Type in your name.

  16. Click Submit. The connection should be dropped this time, and you should see an alert in the log similar to this one:

Was This Article Helpful?

Help us to improve our support portal

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden