A WAF exception is a rule of kind waf_exception: a rule_id and a path_pattern, optionally limited to some names of the zone. On matching paths, that rule adds no points to the anomaly score; the other rules that matched the same request still count.
Find the rule id
Open the blocked (or, in log-only mode, logged) request in security events. Its rule_id is the WAF rule that decided it, for example 942100 (a CRS SQL injection rule), 10002 (an OpenWAF rule) or 1003 (the open redirect shield).
Values of rule_id
rule_id | Effect on the path |
|---|---|
0 | Every WAF rule (OWASP CRS and OpenWAF's rules). Not the shields. |
1001–1008 | That shield only. |
| any other id | That rule only. |
Values of path_pattern
path_pattern | Matches |
|---|---|
empty or * | every path |
ends in *, e.g. /api/upload/* | every path that starts with /api/upload/ |
anything else, e.g. /contact | exactly that path |
The path is compared without the query string, after cleaning // and . segments.
Add an exception
Domain → Security → Firewall → Rules → WAF exceptions → Add WAF exception. Enter the WAF rule (0, a shield id or the rule id), the Path, optionally the names it Applies to and a Note.
openwaf-cloud ctl rules add example.com kind=waf_exception rule_id=942100 path_pattern='/search' \
note="Search box accepts SQL-like text" --reason "False positive on /search"curl -sS -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones/example.com/rules" \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "X-Change-Reason: False positive on /search" \
-H "Content-Type: application/json" \
-d '{"kind": "waf_exception", "rule_id": 942100, "path_pattern": "/search", "note": "Search box accepts SQL-like text"}'add_rule with {"zone": "example.com", "kind": "waf_exception", "rule_id": 942100, "path_pattern": "/search", "reason": "…"}; simulate, then confirm.
Add hosts (hosts:='["shop.example.com"]' in the CLI) to limit the exception to some names. Rules can't be edited: remove the rule and add it again.