Double slashes as WAF Rule

[user4528]

Does anyone know how to create a WAF Rule that blocks Double Slashes (the ones right after the TLD)? I know the htaccess versions but would like to fix it in CF

For Example block:

http://www.example.com//welcome.html

but allow

http://www.example.com/welcome.html

[mdemoura]

You can enable WAF rule with ID 100053 to achieve this.

[user4528]

Thanks for the quick response. I assume this requires Pro level or up ?

[mdemoura]

It does indeed.

But you can also use the following Firewall Rule:

(http.request.full_uri contains "https://www.example.com//")

Just replace the host with your own.

I used http.request.full_uri because http.request.uri.path is already normalized (// -> /) and contains because using a regex is a paid feature if I recall correctly. This isn’t perfect, but should do the job.

[user4528]

Thank you!