WAF policies
JSON AST rules
Author structured expressions that compile to fast matchers.
Goal
Write a valid JSON AST expression for a policy rule.
Prerequisites
- Familiarity with modes and actions.
Expression language
Canonical operators include: and, or, not, eq, ne, contains, startsWith, endsWith, matches, inspector, field, bool.
Example — block SQLi on POST
{
"and": [
{ "eq": ["method", "POST"] },
{ "inspector": "sqli" }
]
}
Example — path prefix
{
"and": [
{ "startsWith": ["path", "/admin"] },
{ "inspector": "xss" }
]
}
Steps
- Open Policies → Rules.
- Paste or build the expression JSON.
- Save—the control plane compile-validates before persisting.
- Confirm auto-publish (or publish manually).
How evaluation works
On each Proxy config swap, expressions compile to delegates. The request path does not re-parse JSON. Inspectors only report hits; policies decide allow/block.
Verify
- Invalid AST is rejected at save time.
- Valid rule appears enabled in the active snapshot.