Are WAF rules case sensitive?

[asi]

I had to change a WAF rule to handle requests with all lower cases and requests with mixed upper/lower cases.

(http.request.uri.path contains “/4di/logos/”) or (http.request.uri.path contains “/4DI/Logos/”)

I would have thought I could just make one rule, http.request.uri.path contains “/4DI/Logos/”, and it would cover any case. And I don’t see a setting to make the rule case insensitive.

[i40west]

They are case-sensitive. You can make a case-insensitive rule by editing the expression manually instead of using the expression builder. Click “edit expression” under the expression editor.

Your expression would be:

(lower(http.request.uri.path) contains "/4di/logos/")

[asi]

Thank you. Does the lower expression work on pro accounts, or is it only for business and enterprise accounts?

[i40west]

It works at all account levels including free.

[asi]

Thank you. I have it working.