DCDN WAF protection policy match conditions-Edge Security Acceleration(ESA)-阿里云帮助中心

When you configure a whitelist or custom rules, you define match conditions to specify which requests to inspect. Each match condition consists of a match field and a logical operator.

What is a match condition

A match condition defines the request characteristics that DCDN WAF inspects at the edge. When you configure a custom protection policy, a whitelist, or an IP address blacklist, you use one or more Match Condition to define the criteria for a rule. If an incoming request meets the match conditions, it triggers the rule. WAF then applies the specified rule action to the request, such as Block, JavaScript Validation, or Monitor.

Supported match fields

The following table describes the available match fields.

Match field	Logical operators	Description
URI	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Length Equals, Length Is Greater Than, Length Is Less Than Starts With, Ends With Regex Match, Regex Mismatch	The uniform resource identifier (URI) of a request, which specifies the resource path. The value must start with a forward slash (`/`) and not include the domain name. For example: `/login.php`.
IP	Is, Is Not Is in, Is Not in	The source IP address of the requesting client. The value must meet the following requirements: Supports individual IPv4 addresses, such as `10.10.10.10`, and CIDR blocks, such as `10.10.10.10/16`. The client IP address corresponds to the `remote_ip` field in DCDN access logs. For more information, see Real-time log fields. You can enter up to 50 values, separated by commas (,). You can reference an IP address group that you have configured in WAF.
Referer	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Exists, Does Not Exist Is Empty Length Equals, Length Is Greater Than, Length Is Less Than Starts With, Ends With Regex Match, Regex Mismatch	The URL of the originating page.
User-Agent	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Exists, Does Not Exist Is Empty Length Equals, Length Is Greater Than, Length Is Less Than Starts With, Ends With Regex Match, Regex Mismatch	Information about the client's browser, such as its identity, rendering engine, and version.
Query string	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Exists, Does Not Exist Length Equals, Length Is Greater Than, Length Is Less Than Starts With, Ends With Regex Match, Regex Mismatch	The part of the URL that follows the question mark (?).
Cookie	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Exists, Does Not Exist Length Equals, Length Is Greater Than, Length Is Less Than Regex Match, Regex Mismatch	The cookie information in the request.
Content-Type	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Length Equals, Length Is Greater Than, Length Is Less Than Regex Match, Regex Mismatch	The media type of the request body, as specified in the Content-Type header. Also known as the MIME type.
Content-Length	Is Less Than, Is Equal To, Is Greater Than	The size of the request body in bytes. Valid values: 0 to 8192.
X-Forwarded-For	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Does Not Exist Length Equals, Length Is Greater Than, Length Is Less Than	The original client IP address, identified by the X-Forwarded-For (XFF) request header when traffic passes through an HTTP proxy or load balancer. This header is present only if the request is routed through a proxy or load balancer.
Request body	Equals, Does Not Equal Contains, Does Not Contain Does Not Exist Starts With Ends With Regex Match	The content of the request body. WAF does not inspect request bodies larger than 8 KB.
HTTP method	Equals, Does Not Equal Equals One of, Does Not Equal Any of	The method used in the request. Supported methods include GET, POST, DELETE, PUT, OPTIONS, CONNECT, HEAD, TRACE, and PATCH.
Header	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Exists, Does Not Exist Length Equals, Length Is Greater Than, Length Is Less Than Regex Match, Regex Mismatch	The request headers. Custom header fields are supported.
URI path	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Length Equals, Length Is Greater Than, Length Is Less Than Starts With, Ends With Regex Match, Regex Mismatch	The path component of the request URI.
Query string parameter	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Length Equals, Length Is Greater Than, Length Is Less Than Starts With, Ends With Regex Match	A parameter in the query string. For example, in the URL `www.abc.com/index.html?action=login`, `action=login` is a parameter.
Host	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Exists Length Equals, Length Is Greater Than, Length Is Less Than Starts With, Ends With Regex Match, Regex Mismatch	The domain name being requested.
CookieName	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Exists Length Equals, Length Is Greater Than, Length Is Less Than Starts With, Ends With Regex Match	The name (or key) of a cookie. For example, in the cookie `acw_tc:111`, `acw_tc` is the cookie name.
BodyParameter	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Exists Length Equals, Length Is Greater Than, Length Is Less Than Starts With, Ends With Regex Match	The name of a parameter in the request body. For example, if a request body contains the string `a=1&b=2`, then `a` and `b` are parameter names.
Filename	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Exists, Does Not Exist Is Empty Length Equals, Length Is Greater Than, Length Is Less Than Starts With, Ends With Regex Match, Regex Mismatch	The name of the file at the end of the URI path. For example, in `/abc/index.php`, the filename is `index.php`.
File extension	Equals, Does Not Equal Equals One of, Does Not Equal Any of Contains, Does Not Contain Contains One of, Does Not Contain Any of Exists, Does Not Exist Is Empty Length Equals, Length Is Greater Than, Length Is Less Than Starts With, Ends With Regex Match, Regex Mismatch	The extension of the requested file, such as `.png` or `.php`.

Logical operators

Logical operator	Description
Is, Is Not	Checks if the field value is or is not the specified IP address or CIDR block.
Contains, Does Not Contain	Checks if the field value contains or does not contain the specified substring.
Is in, Is Not in	Checks if the field value is or is not in the specified list of IP addresses.
Contains One of, Does Not Contain Any of	Checks if the field value contains at least one of the specified substrings, or does not contain any of the specified substrings.
Equals, Does Not Equal	Checks if the field value exactly matches or does not match the specified value.
Equals One of, Does Not Equal Any of	Checks if the field value exactly matches at least one of the specified values, or does not match any of the specified values.
Length Equals, Length Is Greater Than, Length Is Less Than	Compares the length of the field value in bytes to the specified numeric value.
Exists, Does Not Exist	Checks if the specified field exists or does not exist in the request.
Is Less Than, Is Equal To, Is Greater Than	Compares the numeric value of the field to the specified numeric value.
Starts With, Ends With	Checks if the field value starts with or ends with the specified substring.
Regex Match, Regex Mismatch	Checks if the field value matches or does not match the specified regular expression (regex).
Is Empty	Checks if the field value is empty.

Configuration examples

Example 1: Set match field to URI, logical operator to Contains, and Match content to /login.php. This rule triggers if a request's URI contains /login.php.
Example 2: Set match field to IP, logical operator to Is, and Match content to 192.168.0.1. This rule triggers for requests from the IP address 192.168.0.1.