Agent Guides › Web Agent Guide › Enforce Security with URL Monitoring › Specify Bad URL Characters

Specify Bad URL Characters

You can list a set of character sequences that cannot be part of a URL request. These are treated by the Agent as bad URL characters. The Web Agent will refuse URL requests that contain any of the characters or strings of characters that you include in this list. The checking is done on the URL before the "?" character. The Web Agent rejects URL requests that include such characters because a malicious Web client might use such characters to evade SiteMinder rules.

When a Web Agent refuses a URL request containing a Bad URL character, the web server responds with one of the following messages:

• Internal Server Error
• Web Page not Found (404) Error

Check your Web Agent logs for information on how the Agent is handling requests.

You specify the characters with the following parameter:

BadUrlChars

Specifies the character sequences that cannot be used in URL requests. The Web Agent checks the characters in the URL that occur before the "?" character against those specified by this parameter. If any of the specified characters are found, the Web Agent rejects the request.

You can specify the following characters:

• a backward slash (\)
• two forward slashes (//)
• period and a forward slash (./)
• forward slash and a period (/.)
• forward slash and an asterisk (/*)
• an asterisk and a period (*.)
• a tilde (~)
• %2d
• %20
• %00-%1f
• %7f-%ff
• %25

Separate multiple characters with commas. Do not use spaces.

You can use the bad URL characters in CGI parameters if the question mark (?) precedes the bad URL characters.

Default: <,>,&,;

Limits:

• You can specify characters literally or enter the URL-encoded form of that character. For example, you can enter the letter a, or you can enter the encoded equivalent of %61.
• You can specify a maximum number of 4096 characters (including commas used for separating characters).
• You can specify ranges of characters separated by a hyphen. The syntax is: starting_character-ending_character. For example, you can enter a-z as a range of characters.
• Specify quotes (") with the URL-encoded equivalent of %22. Do not use ASCII.

To specify Bad URL characters, edit the value of the BadURLChars parameter to include the characters that you want to block.

Note: When configuring the Apache 2.0 Reverse Proxy Server and Outlook Web Access (OWA), be sure to turn off the BadURLChars parameter. OWA allows unrestricted characters in the email subject that might be listed in the BadURLChars parameter.

More Information

Types of Reverse Proxy Solutions