WAF blocking

Explain an application-firewall rejection to browsers or clients. A web application firewall (WAF) makes the blocking decision; its blocking_page supplies the response body. Use this behavior for a security rejection, rather than a direct route reply.

Body	Choose it for	Measured limitation
Hypertext Markup Language (HTML)	A readable browser rejection page	A benign request remains available.
JavaScript Object Notation (JSON)	A structured message for clients	The example’s parseable body was served as text/html; charset=UTF-8.

Attach the selected firewall

Configure blocking_page on a firewall in blocking mode, then attach that firewall to the load balancer through app_firewall. Both body alternatives use this relationship; select the matching firewall name and namespace.

{
  "spec": {
    "app_firewall": {
      "name": "<APP_FIREWALL_NAME>",
      "namespace": "<XC_NAMESPACE>"
    }
  }
}

The encoded blocking_page value has a 4,096-character limit including the prefix. See response-body encoding to create your own message.

HTML blocking page

Visitor message: Request not accepted

Set blocking_page.response_code to Forbidden and put the HTML message in blocking_page.blocking_page.

HTML blocking page source

{
  "spec": {
    "blocking_page": {
      "response_code": "Forbidden",
      "blocking_page": "string:///PCFkb2N0eXBlIGh0bWw+PGh0bWwgbGFuZz0iZW4iPjxoZWFkPjxtZXRhIGNoYXJzZXQ9InV0Zi04Ij48bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoIj48dGl0bGU+UmVxdWVzdCBub3QgYWNjZXB0ZWQ8L3RpdGxlPjwvaGVhZD48Ym9keT48bWFpbj48aDE+UmVxdWVzdCBub3QgYWNjZXB0ZWQ8L2gxPjxwPkY1IGN1c3RvbSByZXNwb25zZXMgc2hvd2Nhc2UuPC9wPjwvbWFpbj48L2JvZHk+PC9odG1sPg=="
    }
  }
}

Decoded preview (escaped):

<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Request not accepted</title></head><body><main><h1>Request not accepted</h1><p>F5 custom responses showcase.</p></main></body></html>

Expected result: A blocked request returns 403 with the readable page; a benign request still reaches the origin. Check the firewall event: a 403 response alone does not prove the WAF made the block decision.

Verified live example: View the HTML WAF block. The matching enforced WAF event confirms ownership.

JSON blocking message

For application clients, use the same Forbidden code with a JSON body:

JSON blocking page source

{
  "spec": {
    "blocking_page": {
      "response_code": "Forbidden",
      "blocking_page": "string:///eyJtZXNzYWdlIjogIlJlcXVlc3Qgbm90IGFjY2VwdGVkIiwgInNob3djYXNlIjogImN1c3RvbS1yZXNwb25zZXMifQ=="
    }
  }
}

Decoded preview (shown as JSON):

{"message": "Request not accepted", "showcase": "custom-responses"}

Expected result: A blocked request returns 403 with parseable JSON, and the firewall event confirms the block. Inspect Content-Type because a JSON body does not set that header by itself. Compare a benign request with the normal origin response.

Observed media type: XC served this parseable JSON body as text/html; charset=UTF-8. Check whether your client accepts that media type.

Verified live example: View the JSON WAF body. The matching enforced WAF event confirms ownership.

See Rate limits when the rejection comes from a request allowance instead of a firewall rule.