Security FAQ
Attack notifications for ESA
Yes. You can receive notifications by SMS, email, and internal message. By default, notifications are sent to the contact information on your Alibaba Cloud account. To change or add a contact, see Add alert contacts.
Disabled site requests and ESA
All DNS resolution for the site is denied, and ESA edge points of presence (POPs) block all access to the site.
Where do all the protected requests come from?
On the Account Overview page, the system automatically aggregates and analyzes the number of requests from all sites in your account that received protective actions from ESA. If you notice an unusually high volume of protective request data, you can use the following procedure to identify the source of the anomaly:
In the Traffic Statistics dashboard, select a time period such as Yesterday. Click Protected Requests to view the Top 5 Websites by Protected Requests for yesterday.
In the Top 5 Websites by Protected Requests list, click Overview for the site with abnormal data.
In the navigation pane on the left, select Security > Events. Select Custom Time Range, such as
2025-01-28 00:00:00 ~ 2025-01-29 00:00:00, to display the protection action statistics.Scroll down to the Sampling Logs section to view detailed protection information.
Why can't I configure origin protection?
Origin Protection requires a caching architecture with at least two tiers. You cannot enable Origin Protection if your Tiered Cache policy is set to Edge Tiered Cache. To change this, hover over the Configure button and click Modify in the tooltip to navigate to the Tiered Cache configuration page.
On the Tiered Cache page, click Configure, select a suitable tiered caching architecture, and then you can enable Origin Protection.
How do I add IP addresses to the protection list on an ECS instance?
A security group for an ECS instance is a virtual firewall that controls inbound and outbound traffic for the instance. To quickly configure Origin Protection, add the origin-fetch IP list provided by ESA to the inbound rules of a security group.
Go to the ECS console - Prefix lists page. Alternatively, in the ECS console, hover over Network & Security in the navigation pane and click Prefix lists.
Switch to the region where your origin server instance is located, for example,
`China (Hangzhou)`.Click Create prefix list to create a prefix list for IPv4 addresses:
Prefix list name: Enter a name for the list, such as
`list-esa-ipv4`.Address family: Select IPv4.
Max entries: Enter
200.Prefix list entries: Click Add Entry. In the CIDR block column, paste the IPv4 list you obtained when you enabled Origin Protection, and then click OK.
Click Create prefix list to create a prefix list for IPv6 addresses:
Prefix list name: Enter a name for the list, such as
`list-esa-ipv6`.Address family: Select IPv6.
Max entries: Enter
200.Prefix list entries: Click Add Entry. In the CIDR block column, paste the IPv6 list you obtained when you enabled Origin Protection, and then click OK.
Go to the ECS console - Security groups page. Click Create security group. In the Rules section, click Add rule and configure the parameters as described below:
Keep the default values for Traffic direction, Authorization policy, Priority, and Version.
For Source, select Prefix list and then select the IPv4 and IPv6 prefix lists that you created.
For Destination port (this instance), select the ports used by your service, such as
`HTTP(80) and HTTPS(443)`.
After you configure the rule, enter a Security group name, such as
`sg-esa-ip`. For Network, select the same VPC as your origin server. In the Rules section, delete all other default inbound rules, keeping only the prefix list rule you just added. Then, click Confirm creation.Go to ECS console - Instances.
In the instance list, click the ID of the instance for which you want to configure Origin Protection. Go to the Security groups tab and click Change security groups.
On the Change security groups page, select only the security group that you just created, and then click OK.
Why do fetch requests from Functions and Pages fail after origin protection is configured?
Symptom: When the example.com website does not have Origin Protection enabled (because the plan does not support it or the website is not added to ESA), and the IP allowlist of its origin server is configured to include only the ESA Origin Protection IP list, calls to example.com may fail if you use the fetch() function from ESA's Function and Pages.
Solution:
If the
example.comwebsite is added to ESA, you can enable the Origin Protection feature.If the
example.comwebsite is not added to ESA, add the website to ESA, or modify the IP whitelist of the origin server.
What can I do if the origin protection IP ranges exceed the maximum number of IP ranges that my origin server can accept?
If the number of IP address ranges provided by Origin Protection exceeds the limit that your origin server can configure, contact your sales representative to enable the back-to-origin convergence feature (for Enterprise plan customers only). This feature further reduces the number of back-to-origin IP address ranges.
Will the Account Security feature affect legitimate user logins?
If configured correctly, the feature has a minimal impact on legitimate users. ESA uses an AI model to identify anomalous behavior, and normal user activity typically does not trigger protection rules. We recommend the following best practices:
Start in monitor mode.
Gradually tighten the policy based on your observations.
Configure a whitelist for trusted sources.
How can I check whether my Account Security configuration has taken effect?
You can verify the configuration in the following ways:
Check the Security Events page to see if events are being recorded.
Use a test account to intentionally trigger multiple failed login attempts and observe whether they are detected.
Check whether risk scores are calculated as expected.
Why hasn't API Security discovered my APIs?
Check the following items:
Make sure that your site traffic passes through ESA.
Make sure that the API received HTTP requests with a status code other than 5xx in the last 30 days.
For new sites or low-traffic APIs, discovery may take 24 hours or longer to complete.
Can I manually add an API that hasn't been discovered?
Yes, you can. For more information, see Add an API manually.
What is a JWT?
A JSON Web Token (JWT) is an open, JSON-based token format defined in RFC7519 for passing claims between web applications. A JWT is typically used as a standalone authentication token. It can carry information such as the user identifier, user roles, and permissions so that a client can get resources from a resource server. It can also carry additional claims that other business logic requires. This makes JWTs well suited to logon scenarios for distributed sites.
A JWT consists of three parts: Header, Payload, and Signature. Each part is Base64URL-encoded, and the parts form a string in the Header.Payload.Signature format:
Header: the header of the JWT. It carries the claim type (JWT) and the algorithm used to sign the token.
Payload: the data part of the JWT. It stores the effective information and can include custom fields that your user system requires.
Signature: the signature part of the JWT. It verifies the content of the header and the payload.
The following example shows a JWT:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQHow do I generate a JWT?
Use https://mkjwk.org to generate the private key and the public key. The private key is used to generate tokens, and the public key is used to validate tokens.
Use a browser to visit https://mkjwk.org.
Click the EC tab.
Specify the following parameters:
Curve: Select
P-256.Key Use: Select
Signatureas the purpose of the public key.Algorithm: Select
ES256: ECDSA using P-256 and SHA-256as the algorithm identifier.KeyID: Enter a custom key identifier, such as
esa.
Click Generate. Then, select Public Key and click Copy to Clipboard to copy the public key.