Request Path

​

What is a Request Path?

​

Understanding URL Structure

https://example.com/shop/products/shoes?color=blue#reviews
        └─domain─┘  └────request path────┘

​

Common Path Patterns

​

Application Areas

• /admin/* - Administrative interfaces
• /api/* - API endpoints
• /auth/* - Authentication flows
• /user/* - User profiles and settings
• /checkout/* - Purchase flows

​

Sensitive Endpoints

• /login - Authentication entry
• /reset-password - Account recovery
• /api/internal - Internal APIs
• /debug - Debug endpoints (should be disabled in production!)
• /.git - Version control (should never be exposed!)

​

How Paths Work on the Web

• Traditional websites: Each path is a different page (/about, /contact)
• REST APIs: Paths represent resources (/api/users/123)
• Single-page apps: May use one path with client routing (/app/*)
• Static sites: Paths map to actual files (/images/logo.png)

​

Using Request Path in Policies

​

Basic Examples

Field Type: Request Path
Operator: starts with
Value: /admin
Action: Challenge

Field Type: Request Path
Operator: starts with
Value: /api/v2
Action: Monitor

​

Advanced Patterns

Field Type: Request Path
Operator: contains
Value: ../
Action: Block

Field Type: Request Path
Operator: equals
Value: /api/search
Window: 1 minute
Threshold: 10
Action: Challenge

​

Path Matching Operators

​

Best Practices

​

DO:

• Use specific paths for sensitive areas - Be precise with admin/internal paths
• Consider URL patterns - Your app might use /user/123 style paths
• Monitor before blocking - Understand traffic patterns first
• Account for variations - /admin and /admin/ might both exist
• Think about path hierarchy - Protecting /api also protects /api/users

​

DON’T:

• Use overly broad patterns - Blocking all paths with “user” might break legitimate features
• Forget about case sensitivity - /Admin might differ from /admin
• Ignore trailing slashes - They can make a difference
• Block common paths carelessly - / or /api might be too broad

​

Common Attack Patterns

​

Dynamic Paths and Wildcards

# Match user profiles with numeric IDs
/user/[0-9]+

# Match any file in uploads
/uploads/*

# Match specific file types
*.pdf

​

Combining with Other Fields

# Suspicious: POST to a typically GET endpoint
Field Type: Request Path
Operator: equals
Value: /search
AND
Field Type: Request Method
Operator: equals
Value: POST
Action: Block

​

Troubleshooting

• Check for trailing slashes
• Verify URL encoding (%20 for spaces)
• Confirm the exact path in your server logs
• Remember query parameters are not part of the path

• Your pattern might be too broad
• Check for unexpected path variations in your app
• Consider using Challenge instead of Block initially

​

Related Fields

• Request Method - Combine for precise endpoint control
• Query Parameters - Additional URL information
• Headers - May contain path-related information
• Referrer - Shows which path users came from