The attack is either on /?[random chars] or index.php?[random chars]
This is what I tried but it doesn’t seems to be effective as it doesn’t issue the challenge.
Rules:
(http.request.uri.query contains “?” and not cf.client.bot) or (http.request.uri.path contains “?” and not cf.client.bot) or (http.request.uri.query eq “?QQQQQQQQ=QQQQQQQQ” and not cf.client.bot)
I’m quiet lost now, as the attacker can bypass cache with this.
First question, are you using the query string (the bit after “?”) at all on your site? If not, you could either switch your caching strategy to “No query string” or use a firewall rule to block requests with query strings altogether.
The former would not block the requests, however random strings wouldnt circumvent the cache at least.
The latter should be achievable with either one of these rules (try them out).
Yes I do use the query string and therefore I can’t cache all of the content.
It’s being used with Ajax & other GET Requests all together therefore if that would be cached, the site wouldn’t work.
I have tried this before ```
(http.request.uri contains “?”)
I would just need to make a firewall rule for index.php or login.php but not the ajax requests.
Therefore domain/index.php?random domain/login.php?random would be cached but not domain/ajax/files.php?get
Hope you understand, thanks for your time.
That should work. Can you post a few examples where you have query strings and which files you’d like to block if a query string is sent and which not?
