cds-snc / notification-planning-core

Project planning for GC Notify Core Team

0 stars 0 forks source link

refine WAF url rules #316

Open sastels opened 3 months ago

sastels commented 3 months ago

Description

As a Notifiy owner, I need Notify to be secure against fuzzing attacks

WHY are we building?

Stop requests to invalid urls

WHAT are we building?

Refine WAF rules. For example, instead of /services/* we could restrict to /services/[regex for uuid]/*

VALUE created by our solution

Block more attacks. Have see requests to, for example, /services/<service_id>/service-settings

Acceptance Criteria

Given some context, when (X) action occurs, then (Y) outcome is achieved.

[ ] refine WAF rules to add some sort of regex where UUIDs should appear

QA Steps

[ ] requests to /services/<service_id>/service-settings are blocked
[ ] Verify using Athena queries on staging and production that similar requests are now being blocked