Header blocking In WAF is not working

[servers4]

Hello! I created rule in WAF to block request by header. I used expression:

any(lower(http.request.headers.names[*])[*] == "X-SONDE")

But i still can get requested resource even with X-SONDE header… There is no other rules.
What i’m doing wrong?

[michael]

You are converting the incoming header to lowercase, but comparing to the UPPERCASE version. Change to:

any(lower(http.request.headers.names[*])[*] == "x-sonde")

[servers4]

Thanks! It works!