sneak/smallwebwaf
1
0
Fork 0
Code Issues 17 Pull Requests 4 Actions 9 Packages Projects Releases Wiki Activity

Lower the default request and byte limits (closes #193)
check / check (push) Waiting to run
Details

Browse Source 
Requests: 120 a minute, 1,500 an hour, 6,000 a day. Bytes: no minute
limit, 50G an hour, 100G a day. The README, SPEC.md, docs/settings.md
and docs/gitea.md give the new defaults and the reasons for them. The
README examples no longer raise the byte limits for gitea, and the
static-site example sits below the new request defaults.

Model: opus-5-5
This commit is contained in:
sneak
2026-11-06 17:55:06 +00:00
parent 6deb9d7581
commit ac4162c5d4
7 changed files with 86 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+16 -22
View File
@@ -26,10 +26,10 @@ It protects against:
- Scrapers that fetch every page of a site, all day. Each client gets a limit on - Scrapers that fetch every page of a site, all day. Each client gets a limit on
requests and on bytes per minute, per hour and per day. The defaults leave requests and on bytes per minute, per hour and per day. The defaults leave
room for programmatic use of an API, such as an automation fleet, and catch a room for a person reading a site for hours. They catch a scraper that keeps up
client firing requests as fast as it can within seconds. A client over a limit one request every 2 seconds within an hour. A client over a limit is refused
is refused and banned: for a while at first, for three times as long at each and banned: for a while at first, for three times as long at each repeat, and
repeat, and permanently when it keeps at it. permanently when it keeps at it.
- Scanners that probe for secrets, such as `/.env` or `/.git/config`. The - Scanners that probe for secrets, such as `/.env` or `/.git/config`. The
default rule file bans such a client at its first probe, and its next request default rule file bans such a client at its first probe, and its next request
during the ban makes the ban permanent. Your own rules, or a list of trap during the ban makes the ban permanent. Your own rules, or a list of trap
@@ -237,13 +237,13 @@ Every setting the code reads, with its default:
| `SWWAF_ALLOW_NETS` | empty | Netblocks whose clients skip every check, such as your monitoring. | | `SWWAF_ALLOW_NETS` | empty | Netblocks whose clients skip every check, such as your monitoring. |
| `SWWAF_RATE_LIMIT_EXEMPT_NETS` | empty | Netblocks whose clients the request and byte limits neither count nor refuse. | | `SWWAF_RATE_LIMIT_EXEMPT_NETS` | empty | Netblocks whose clients the request and byte limits neither count nor refuse. |
| `SWWAF_DENY_NETS` | empty | Netblocks whose clients are refused. | | `SWWAF_DENY_NETS` | empty | Netblocks whose clients are refused. |
| `SWWAF_RATE_LIMIT_PER_MINUTE` | `500` | The most requests a client may make in a minute, a count or `off`; one more bans it. | | `SWWAF_RATE_LIMIT_PER_MINUTE` | `120` | The most requests a client may make in a minute, a count or `off`; one more bans it. |
| `SWWAF_RATE_LIMIT_PER_HOUR` | `20000` | The most requests a client may make in an hour, a count or `off`; one more bans it. | | `SWWAF_RATE_LIMIT_PER_HOUR` | `1500` | The most requests a client may make in an hour, a count or `off`; one more bans it. |
| `SWWAF_RATE_LIMIT_PER_DAY` | `300000` | The most requests a client may make in a day, a count or `off`; one more bans it. | | `SWWAF_RATE_LIMIT_PER_DAY` | `6000` | The most requests a client may make in a day, a count or `off`; one more bans it. |
| `SWWAF_RATE_LIMIT_EXEMPT_PATHS` | empty | Path prefixes whose requests the request and byte limits neither count nor refuse, such as `/assets/`. | | `SWWAF_RATE_LIMIT_EXEMPT_PATHS` | empty | Path prefixes whose requests the request and byte limits neither count nor refuse, such as `/assets/`. |
| `SWWAF_BYTES_LIMIT_PER_MINUTE` | `4G` | The most bytes a client's requests may carry in a minute, a size or `off`; the request that takes a client past any byte limit bans it. | | `SWWAF_BYTES_LIMIT_PER_MINUTE` | `off` | The most bytes a client's requests may carry in a minute, a size or `off`; the request that takes a client past any byte limit bans it. |
| `SWWAF_BYTES_LIMIT_PER_HOUR` | `20G` | The most bytes a client's requests may carry in an hour, a size or `off`. | | `SWWAF_BYTES_LIMIT_PER_HOUR` | `50G` | The most bytes a client's requests may carry in an hour, a size or `off`. |
| `SWWAF_BYTES_LIMIT_PER_DAY` | `200G` | The most bytes a client's requests may carry in a day, a size or `off`. | | `SWWAF_BYTES_LIMIT_PER_DAY` | `100G` | The most bytes a client's requests may carry in a day, a size or `off`. |
| `SWWAF_BYTES_COUNT` | `both` | Which body bytes the byte limits count: `response`, `request` or `both`. | | `SWWAF_BYTES_COUNT` | `both` | Which body bytes the byte limits count: `response`, `request` or `both`. |
| `SWWAF_ERROR_BURST_THRESHOLD` | `30` | The most refusals by a rule file, a trap path or the Core Rule Set a client may get in a minute, a count or `off`; one more bans it. | | `SWWAF_ERROR_BURST_THRESHOLD` | `30` | The most refusals by a rule file, a trap path or the Core Rule Set a client may get in a minute, a count or `off`; one more bans it. |
| `SWWAF_BAN_RESPONSE` | `403` | How a refused client is answered: `403`, `429` or `close`, which drops the connection. | | `SWWAF_BAN_RESPONSE` | `403` | How a refused client is answered: `403`, `429` or `close`, which drops the connection. |
@@ -408,10 +408,10 @@ services:
SWWAF_RATE_LIMIT_EXEMPT_NETS: 203.0.113.0/24,198.51.100.7 SWWAF_RATE_LIMIT_EXEMPT_NETS: 203.0.113.0/24,198.51.100.7
# A netblock that sends nothing wanted. # A netblock that sends nothing wanted.
SWWAF_DENY_NETS: 198.51.100.128/25 SWWAF_DENY_NETS: 198.51.100.128/25
# Tighter limits for everyone else: a site with no API. # Tighter limits for everyone else: a small static site.
SWWAF_RATE_LIMIT_PER_MINUTE: "120" SWWAF_RATE_LIMIT_PER_MINUTE: "60"
SWWAF_RATE_LIMIT_PER_HOUR: "3000" SWWAF_RATE_LIMIT_PER_HOUR: "600"
SWWAF_RATE_LIMIT_PER_DAY: "30000" SWWAF_RATE_LIMIT_PER_DAY: "3000"
# Hosting networks and one country get a share of those limits. # Hosting networks and one country get a share of those limits.
SWWAF_ASN_LIMIT_PERCENT: AS14061:50,AS16276:25 SWWAF_ASN_LIMIT_PERCENT: AS14061:50,AS16276:25
SWWAF_COUNTRY_LIMIT_PERCENT: cn:25 SWWAF_COUNTRY_LIMIT_PERCENT: cn:25
@@ -432,10 +432,9 @@ volumes:
gitea behind traefik, set up for a code forge: gitea behind traefik, set up for a code forge:
- the upload limits raised, in size and in time; - the upload limits raised, in size and in time;
- the response size limit and the byte limits raised, for clones over 1 GiB; - the response size limit raised, for clones over 1 GiB;
- the Actions runners exempt from counting; - the Actions runners exempt from counting;
- the default request limits kept, since they already leave room for API - the default request and byte limits kept.
clients.
`traefik` is the network traefik is on, made outside this file. `traefik` is the network traefik is on, made outside this file.
@@ -489,11 +488,6 @@ services:
SWWAF_INSTANCE_NAME: fsn1/servewaf SWWAF_INSTANCE_NAME: fsn1/servewaf
# The Actions runners ask for work all day; never count them. # The Actions runners ask for work all day; never count them.
SWWAF_RATE_LIMIT_EXEMPT_NETS: 10.0.4.0/24 SWWAF_RATE_LIMIT_EXEMPT_NETS: 10.0.4.0/24
# Raised with rproxy's response limit, to four times the default
# each, so that one clone of that size breaks no byte limit.
SWWAF_BYTES_LIMIT_PER_MINUTE: 16G
SWWAF_BYTES_LIMIT_PER_HOUR: 80G
SWWAF_BYTES_LIMIT_PER_DAY: 800G
# gitea never serves these; a request for one bans the client. # gitea never serves these; a request for one bans the client.
SWWAF_TRAP_PATHS: /wp-login.php,/xmlrpc.php,/wp-admin/ SWWAF_TRAP_PATHS: /wp-login.php,/xmlrpc.php,/wp-admin/
volumes: volumes:
SPEC.md
+26 -29
View File
@@ -397,32 +397,32 @@ Conventions:
### Request rate limits, per client ### Request rate limits, per client
Breaking one bans the client. The defaults suit programmatic use of an API, such Breaking one bans the client. The defaults let people read a site and stop
as an automation fleet on another host, and still stop abusive bots. A fleet of scrapers that send many requests slowly over hours or days. The hour limit is
20 agents, each making a request every 10 seconds at its busiest, makes 120 the main one.
requests a minute and 7,200 an hour. Working around the clock, it makes 172,800
a day. It stays under all three limits.
- Per minute: 500, about 8 requests a second. It leaves room for the fleet's 120 - Per minute: 120, 2 requests a second. It leaves room for a person opening
a minute and a few quick first visits with an empty cache. A gitea page opened several pages at once with an empty cache. A gitea page opened with an empty
with an empty cache loads about 40 files. A client firing requests as fast as cache loads 20 to 60 files, and a handful once cached.
it can passes the limit within seconds. - Per hour: 1,500. A person reading code in gitea for a whole hour, a page every
- Per hour: 20,000, about 5.5 requests a second for a whole hour. A client that 20 seconds, makes about 900 requests. A scraper making one request every 2
keeps up 6 a second makes 21,600 in an hour, and passes it, at 360 a minute, seconds passes the limit within 50 minutes.
under the minute limit. The fleet's 7,200 an hour is about a third of it. - Per day: 6,000, four heavy hours of reading. A scraper making one request
- Per day: 300,000, about 3.5 requests a second around the clock. A scraper that every 10 seconds passes it within 17 hours.
keeps up 4 a second makes 345,600 a day, and passes it. At 240 a minute and
14,400 an hour, it stays under the other two limits.
Counting cannot catch a client that stays under all three limits, such as one Counting cannot catch a client that stays under all three limits, about 4
that keeps up 3 requests a second. Only the other checks can catch an abuser requests a minute around the clock. Only the other checks can catch an abuser
that slow. They include the trap paths, the rule files, the Core Rule Set and that slow. They include the trap paths, the rule files, the Core Rule Set and
the blocklists. An abuser that trips none of them is not caught. A machine that the blocklists. An abuser that trips none of them is not caught.
keeps up more than 500 requests a minute passes the minute limit. One that keeps
up more than about 5.5 a second for an hour passes the hour limit. One that Some legitimate clients pass the limits:
keeps up more than about 3.5 a second all day passes the day limit, as two busy
Actions runners on one address do. Such a machine's address belongs in - An Actions runner asks gitea for work every 2 seconds, about 1,800 requests an
`SWWAF_RATE_LIMIT_EXEMPT_NETS`. hour.
- Everyone behind one shared address, such as an office, shares one client's
limits.
Their addresses belong in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
`SWWAF_RATE_LIMIT_EXEMPT_PATHS` takes path prefixes out of the count, such as `SWWAF_RATE_LIMIT_EXEMPT_PATHS` takes path prefixes out of the count, such as
static assets or health checks; their bytes are not counted either. A prefix is static assets or health checks; their bytes are not counted either. A prefix is
@@ -435,12 +435,9 @@ matched the same way.
### Byte limits, per client ### Byte limits, per client
The hour and day limits sit about twice above what 40 people busy with heavy web There is no minute limit, so a client can download in a burst at full speed. The
apps move together on one address. Each moves about 256 MiB an hour, for ten hour limit is 50 GiB and the day limit 100 GiB. They allow several downloads of
hours a day. A response's bytes are counted when it ends (see step 15). So the a few GiB each. A response's bytes are counted when it ends (see step 15).
minute limit holds three of the largest responses, with their requests, ending
in the same minute. No single download then breaks a limit. An operator who
raises `SWRP_MAX_RESPONSE_SIZE` must raise the byte limits too.
### Lookup of AS number and country ### Lookup of AS number and country
docs/gitea.md
+7 -11
View File
@@ -14,8 +14,7 @@ version.
by it. by it.
- A clone is a response. It fits the defaults of 30 minutes and 1 GiB unless the - A clone is a response. It fits the defaults of 30 minutes and 1 GiB unless the
repository is large or the link slow. A repository whose clone is larger than repository is large or the link slow. A repository whose clone is larger than
1 GiB needs `SWRP_MAX_RESPONSE_SIZE` raised, and the byte limits with it 1 GiB needs `SWRP_MAX_RESPONSE_SIZE` raised.
("Byte limits, per client" in `SPEC.md`).
- A push is a request, and so is every other upload: - A push is a request, and so is every other upload:
- a git push; - a git push;
- an LFS object; - an LFS object;
@@ -32,15 +31,12 @@ version.
request limits do most of the work there. request limits do most of the work there.
- An Actions runner that reaches gitea through `smallwebwaf` sends requests all - An Actions runner that reaches gitea through `smallwebwaf` sends requests all
day. One older than version 0.4 (April 2026) asks for work every 2 seconds, day. One older than version 0.4 (April 2026) asks for work every 2 seconds,
43,200 requests a day. While it runs a job, it reports the job's log and state 1,800 requests an hour. While it runs a job, it reports the job's log and
every second instead, two requests a second. So one runner busy all day sends state every second instead, two requests a second. So one idle runner passes
120 requests a minute and 172,800 a day, under the request limits. Two such the hour limit of 1,500 within 50 minutes. A busy one passes it within 13
runners on one address, each busy all day, make 345,600 and pass the day limit minutes. Its address is then banned, its running jobs fail, and each repeat
of 300,000. Three busy at once make 21,600 an hour and pass the hour limit of within a day makes the ban longer. Newer runners ask for work less often. Put
20,000. Five busy at once make 600 a minute and pass the minute limit of 500. the runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
Their address is then banned, their running jobs fail, and each repeat within
a day makes the ban longer. Newer runners ask for work less often. Put the
runners' addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`.
## What the Core Rule Set lets through ## What the Core Rule Set lets through
docs/settings.md
+17 -15
View File
@@ -99,19 +99,21 @@ chooses between the two (see "The image's command" below).
## Request rate limits, per client ## Request rate limits, per client
- `SWWAF_RATE_LIMIT_PER_MINUTE` (default `500`, about 8 a second): the most - `SWWAF_RATE_LIMIT_PER_MINUTE` (default `120`, 2 a second): the most requests a
requests a client may make in a minute. A count or `off`. The default catches, client may make in a minute. A count or `off`. The default leaves room for a
within seconds, a client firing requests as fast as it can. It leaves room for person opening several gitea pages at once with an empty cache, 20 to 60 files
a fleet of about 20 agents at its busiest, about 120 requests a minute. It each.
also leaves room for a few quick first visits to gitea with an empty cache, - `SWWAF_RATE_LIMIT_PER_HOUR` (default `1500`): the most requests a client may
about 40 files each. make in an hour. A count or `off`. It is the main limit against scrapers. A
- `SWWAF_RATE_LIMIT_PER_HOUR` (default `20000`, about 5.5 a second): the most person reading code in gitea for an hour, a page every 20 seconds, makes
requests a client may make in an hour. A count or `off`. The default leaves about 900. A scraper making one request every 2 seconds passes it within 50
room for an automation fleet at work. It catches a client that keeps up more minutes.
than about 5.5 a second for an hour. - `SWWAF_RATE_LIMIT_PER_DAY` (default `6000`): the most requests a client may
- `SWWAF_RATE_LIMIT_PER_DAY` (default `300000`, about 3.5 a second): the most make in a day. A count or `off`. The default is four heavy hours of reading. A
requests a client may make in a day. A count or `off`. The default catches a scraper making one request every 10 seconds passes it within 17 hours.
scraper that keeps up 4 a second around the clock. - Actions runners make about 1,800 requests an hour, and pass the hour limit.
Put their addresses in `SWWAF_RATE_LIMIT_EXEMPT_NETS`. Do the same for a
network where many people share one address, such as an office.
- Counting cannot catch a client that stays under all three limits (see "Request - Counting cannot catch a client that stays under all three limits (see "Request
rate limits, per client" in [`SPEC.md`](../SPEC.md)). rate limits, per client" in [`SPEC.md`](../SPEC.md)).
- `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes exempt from - `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes exempt from
@@ -119,8 +121,8 @@ chooses between the two (see "The image's command" below).
## Byte limits, per client ## Byte limits, per client
- `SWWAF_BYTES_LIMIT_PER_MINUTE` (default `4G`), `SWWAF_BYTES_LIMIT_PER_HOUR` - `SWWAF_BYTES_LIMIT_PER_MINUTE` (default `off`), `SWWAF_BYTES_LIMIT_PER_HOUR`
(default `20G`) and `SWWAF_BYTES_LIMIT_PER_DAY` (default `200G`): the most (default `50G`) and `SWWAF_BYTES_LIMIT_PER_DAY` (default `100G`): the most
bytes counted for a client in each window. A size or `off`. bytes counted for a client in each window. A size or `off`.
- `SWWAF_BYTES_COUNT` (default `both`): which body bytes the byte limits count: - `SWWAF_BYTES_COUNT` (default `both`): which body bytes the byte limits count:
`response`, `request` or `both`. `response`, `request` or `both`.
internal/config/config.go
+6 -6
View File
@@ -468,13 +468,13 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
AllowNets: env.netblocks("SWWAF_ALLOW_NETS", ""), AllowNets: env.netblocks("SWWAF_ALLOW_NETS", ""),
RateLimitExemptNets: env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""), RateLimitExemptNets: env.netblocks("SWWAF_RATE_LIMIT_EXEMPT_NETS", ""),
DenyNets: env.netblocks("SWWAF_DENY_NETS", ""), DenyNets: env.netblocks("SWWAF_DENY_NETS", ""),
RateLimitPerMinute: env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "500"), RateLimitPerMinute: env.count("SWWAF_RATE_LIMIT_PER_MINUTE", "120"),
RateLimitPerHour: env.count("SWWAF_RATE_LIMIT_PER_HOUR", "20000"), RateLimitPerHour: env.count("SWWAF_RATE_LIMIT_PER_HOUR", "1500"),
RateLimitPerDay: env.count("SWWAF_RATE_LIMIT_PER_DAY", "300000"), RateLimitPerDay: env.count("SWWAF_RATE_LIMIT_PER_DAY", "6000"),
RateLimitExemptPaths: env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""), RateLimitExemptPaths: env.pathPrefixes("SWWAF_RATE_LIMIT_EXEMPT_PATHS", ""),
BytesLimitPerMinute: env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "4G"), BytesLimitPerMinute: env.size("SWWAF_BYTES_LIMIT_PER_MINUTE", "off"),
BytesLimitPerHour: env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "20G"), BytesLimitPerHour: env.size("SWWAF_BYTES_LIMIT_PER_HOUR", "50G"),
BytesLimitPerDay: env.size("SWWAF_BYTES_LIMIT_PER_DAY", "200G"), BytesLimitPerDay: env.size("SWWAF_BYTES_LIMIT_PER_DAY", "100G"),
BytesCount: env.bytesCount("SWWAF_BYTES_COUNT", "both"), BytesCount: env.bytesCount("SWWAF_BYTES_COUNT", "both"),
LookupSource: env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"), LookupSource: env.lookupSource("SWWAF_LOOKUP_SOURCE", "geojs"),
LookupDBPath: env.value("SWWAF_LOOKUP_DB_PATH", ""), LookupDBPath: env.value("SWWAF_LOOKUP_DB_PATH", ""),
internal/config/config_test.go
+11 -11
View File
@@ -244,9 +244,9 @@ func TestDefaults(t *testing.T) {
wantSettings(t, cfg, config.Config{ wantSettings(t, cfg, config.Config{
ListenAddr: ":8080", ListenAddr: ":8080",
Observe: false, Observe: false,
RateLimitPerMinute: 500, RateLimitPerMinute: 120,
RateLimitPerHour: 20000, RateLimitPerHour: 1500,
RateLimitPerDay: 300000, RateLimitPerDay: 6000,
BanResponse: 403, BanResponse: 403,
LimitBanDuration: time.Hour, LimitBanDuration: time.Hour,
LimitBanRepeatWindow: 24 * time.Hour, LimitBanRepeatWindow: 24 * time.Hour,
@@ -266,8 +266,8 @@ func TestDefaults(t *testing.T) {
LookupSource: defaultLookupSource, LookupTimeout: 800 * time.Millisecond, LookupSource: defaultLookupSource, LookupTimeout: 800 * time.Millisecond,
}) })
wantByteLimitSettings(t, cfg, config.Config{ wantByteLimitSettings(t, cfg, config.Config{
BytesLimitPerMinute: 4 << 30, BytesLimitPerHour: 20 << 30, BytesLimitPerMinute: 0, BytesLimitPerHour: 50 << 30,
BytesLimitPerDay: 200 << 30, BytesCount: "both", BytesLimitPerDay: 100 << 30, BytesCount: "both",
}) })
wantNetblocks(t, cfg.AllowNets) wantNetblocks(t, cfg.AllowNets)
@@ -308,7 +308,7 @@ func TestNoSingleRequestBreaksAByteLimitAtTheDefaults(t *testing.T) {
for _, limit := range []int64{ for _, limit := range []int64{
cfg.BytesLimitPerMinute, cfg.BytesLimitPerHour, cfg.BytesLimitPerDay, cfg.BytesLimitPerMinute, cfg.BytesLimitPerHour, cfg.BytesLimitPerDay,
} { } {
if largest > limit { if limit != 0 && largest > limit { // 0 is off
t.Errorf("a request of %d bytes breaks the byte limit of %d", largest, limit) t.Errorf("a request of %d bytes breaks the byte limit of %d", largest, limit)
} }
} }
@@ -2271,12 +2271,12 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
rateLimitExemptNets: "", rateLimitExemptNets: "",
denyNets: "", denyNets: "",
rateLimitPerMinute: "45", rateLimitPerMinute: "45",
rateLimitPerHour: "20000", rateLimitPerHour: "1500",
rateLimitPerDay: "300000", rateLimitPerDay: "6000",
rateLimitExemptPaths: "", rateLimitExemptPaths: "",
bytesLimitPerMinute: "4G", bytesLimitPerMinute: "off",
bytesLimitPerHour: "20G", bytesLimitPerHour: "50G",
bytesLimitPerDay: "200G", bytesLimitPerDay: "100G",
bytesCount: "both", bytesCount: "both",
lookupSource: defaultLookupSource, lookupSource: defaultLookupSource,
lookupDBPath: "", lookupDBPath: "",
internal/smallwebwaf/smallwebwaf_test.go
+3 -3
View File
@@ -1225,9 +1225,9 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
"SWWAF_ALLOW_NETS": "", "SWWAF_ALLOW_NETS": "",
rateLimitExemptNets: "", rateLimitExemptNets: "",
"SWWAF_DENY_NETS": "", "SWWAF_DENY_NETS": "",
"SWWAF_RATE_LIMIT_PER_MINUTE": "500", "SWWAF_RATE_LIMIT_PER_MINUTE": "120",
"SWWAF_RATE_LIMIT_PER_HOUR": "20000", "SWWAF_RATE_LIMIT_PER_HOUR": "1500",
rateLimitPerDay: "300000", rateLimitPerDay: "6000",
"SWWAF_RATE_LIMIT_EXEMPT_PATHS": "", "SWWAF_RATE_LIMIT_EXEMPT_PATHS": "",
"SWWAF_DENIED_COUNTRIES": "", "SWWAF_DENIED_COUNTRIES": "",
"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES": "", "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES": "",