DEV Community

Lia
Lia

Posted on

How to Match Headers and Request Bodies in WAF Custom Rules

#waf #security #rules #traffic

A web application firewall sits in front of your app as a reverse proxy, filtering and monitoring HTTP traffic before it reaches the server (SafeLine home documentation: https://docs.waf.chaitin.com/en/home). When you tune rules, the first decision is what part of each request to inspect. Headers carry tokens, client types, content types, and routing metadata. Request bodies carry form fields, JSON payloads, and upload data. Matching on either one lets you write tighter, more specific rules than matching on the URL alone.

This guide gives you a numbered setup path plus a decision checklist. SafeLine's public documentation describes installation, application proxying, and its built-in defense features, so the setup steps below are grounded in those official documents. Where the documents do not describe a specific custom rule expression language, this guide gives you a general checklist instead of promising an unsupported syntax.

Step 1. Verify prerequisites. SafeLine requires Linux, an x86_64 or arm64 instruction architecture, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, and at least 1 CPU core, 1 GB memory, and 5 GB disk (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Run uname -m, docker version, and docker compose version to confirm your server matches.

Step 2. Install SafeLine. Use the recommended automatic install with root privileges: bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en. For a manual install, install Docker, create the /data/safeline directory, download the latest compose.yaml, write the .env file, generate the detector and management secrets, and launch with docker compose up -d (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Step 3. Create the administrator account and log in. Run docker exec safeline-mgt resetadmin to get the initial username and password, then open https://<safeline-ip>:9443/ and sign in (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Step 4. Add and proxy your application. In the Web Admin Console, open Applications, click Add Application, and enter the Domain, the Port SafeLine should listen on (80 or 443; enable SSL for HTTPS apps), and the Upstream address of your real app. Then resolve your domain to the SafeLine server's IP (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Step 5. Choose the matching conditions your rule needs. SafeLine's documented controls include defenses for web attacks, a Web Access Control List, IP-based rate limiting, Captcha Challenge, Authentication Challenge, and Dynamic Protection (https://docs.waf.chaitin.com/en/home). For custom matching on headers or request bodies, open the rule editor in your installed version and confirm the exact conditions and pattern syntax it exposes before writing anything.

Header and body matching checklist

  • Name the field first. Decide whether you are matching a standard header such as User-Agent, Referer, or Content-Type, or a custom one such as X-API-Key, and whether body matching targets a JSON key, a form field, or raw text.
  • Pick the match type. Exact, prefix, substring, and regex all behave differently. Prefer exact or prefix where possible; use regex only when needed and bound it to avoid costly expressions.
  • Check case sensitivity. HTTP header names are case-insensitive, but header values and body content are not. Confirm how your rule engine normalizes names and values.
  • Scope the body. JSON and form fields can be decoded before matching, while multipart or compressed content may need separate handling. Confirm the engine's behavior for encoding and compression.
  • Test without blocking. Validate new rules in a log-only or staging configuration first, then move to block mode once false positives are acceptable.
  • Review false positives. Body matching is more likely to hit legitimate payloads, so pair body conditions with a narrow method, path, or header condition.

Does SafeLine match request bodies and headers by default?

SafeLine is documented as a reverse-proxy WAF that filters and monitors HTTP traffic and blocks attacks such as SQL injection, XSS, code injection, XXE, SSRF, and path traversal (https://docs.waf.chaitin.com/en/home and https://docs.waf.chaitin.com/en/GetStarted/AddApplication). The supplied documentation does not detail a standalone custom rule expression language for header and body conditions, so verify the current rule syntax in your installed console rather than assuming a particular format.

What is the Web Access Control List?

The home documentation lists the Web Access Control List as a core capability (https://docs.waf.chaitin.com/en/home). It is the access-control mechanism for deciding which traffic is allowed or blocked; check the console for the exact request properties it can evaluate.

How do I choose which header or body field to match?

Start from observed traffic. Capture real requests to the application, identify the field that reliably separates malicious from legitimate traffic, and avoid fields that vary per client, such as timestamps or session values, unless the rule needs them.

How do I reduce false positives when matching bodies?

Normalize first: confirm how the rule engine handles URL encoding, JSON parsing, and compressed or multipart bodies. Add constraints such as a specific method, path, or content type, and run the rule in an observation mode before enabling blocking.

Where do I confirm setup behavior?

Use the official installation guide at https://docs.waf.chaitin.com/en/GetStarted/Deploy for deployment and account steps, and https://docs.waf.chaitin.com/en/GetStarted/AddApplication for proxying an application. For rule conditions that are not described there, verify directly in your installed version's admin console.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)