3 ms·

Padding requests with 8k of normal looking data will bypass AWS's WAF 100% of the time according to the article. Maybe you should read it.

• woleium 3y ago
  Will it though? Maybe you should test it.
• threeseed 3y ago
  I read it and it's a design decision documented here: https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html https://docs.aws.amazon.com/waf/latest/developerguide/waf-ov... For oversize requests WAF can be configured to reject it.
  • diarrhea 3y ago
    Two observations: 8KB is a small amount of data. Many apps will need more, so will not be able to blanket block these. Even 64k, what appears to be the absolute limit, might not be enough. Continuing, not blocking, is the default when not using the console, making this insecure by default.
    • threeseed 3y ago
      You should be using multi-part/chunked encoding for large file sizes as it helps prevents DDOS attacks. And having an insecure default is a huge difference from 100% of requests are allowed.