How to configure Security Templates?
Plevne WAS works to increase the security of Workcube applications. Security templates working with Plevne WAS try to prevent risky content by checking incoming data for the security of your system.
With Security Templates, all data coming to the system (such as GET, POST) passes through a filter and reaches the modules. Security templates that work at the request level stop the request (Drop Request) when they encounter potentially unwanted data. Thus, the system blocks the incoming data before it is processed or recorded.
Why is request filtering done?
Request filtering is a common method used in web-based applications. This method works with the same logic as firewalls. Firewalls examine requests before they reach the application server and, when deemed necessary, block the data before it reaches the application server. However, nowadays, customizing firewalls for applications involves both difficult configurations and high management costs.
*This is not a recommendation against using a firewall, firewalls aim to protect the entire network.
Request filtering at the application level with security templates has now been made dynamic on Workcube. Security templates are implemented according to regular expression rules. Security templates are located under the "Security" section. Templates can be added in three groups on the security templates screen;
Standard Template
This template is the template planned for standard use. The standard template also automatically includes Light and Dark templates. It is for the most rules and the most common use. For example, harmful or unwanted words that may appear in text content can be entered into this template, for example
onclick
alter
div
Requests containing these words will be stopped. In addition, the standard template includes other types of templates.
Light Template
It is used to define slightly more detailed rules than the standard template. For example,
onclick=".*body.*"
alter\s+table