FortiWeb Lesson 02: Read HTTP, HTTPS, Headers, Cookies and JSON
FORTIWEB CLASSROOM • LESSON 02
Level: Beginner · Study and lab: 45 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP
FortiWeb course guide · FortiWeb training block
Learn to read the traffic first
Policy tuning begins with understanding a request. Today you will identify the method, hostname, path, input parameters, headers, cookies, and body. You can complete the observation exercise before installing FortiWeb.
Read this illustrative HTTP/1.1 request
GET /search?q=cloud HTTP/1.1 Host: books.example.test Accept: text/html Cookie: session=LAB_VALUE_ONLY
GET is the method. /search is the path. q=cloud is a query parameter. The Host header identifies the website requested. Cookies carry browser-stored values. HTTP/2 encodes messages differently, but many of these concepts remain.
A POST request may carry an order in its body: {"bookId":42,"quantity":1}. The Content-Type header describes the intended format, such as application/json. The receiver still has to parse and validate the actual bytes. A client can send an incorrect header.
Understand the response
A response has a status code, headers, and often a body. Codes in the 2xx range generally indicate success, 3xx redirection, 4xx a request-side problem, and 5xx a server-side failure. A 403 does not by itself prove FortiWeb blocked the request. Another proxy or the application could produce it.
Where HTTPS inspection happens
HTTPS protects HTTP with TLS encryption. To inspect the application payload, FortiWeb needs appropriate plaintext visibility. In our reverse-proxy design, it terminates the client-side TLS connection and can establish a separate encrypted connection toward the origin. Design and verify the trust settings for both connections.
Do not assume that installing a certificate enables inspection in every topology. Passive decryption has protocol and key-exchange limitations. We use reverse proxy for the lab to make the inspection point clear; other modes require their own design review.
Guided exercise
- Open Developer Tools in your browser and choose Network.
- Visit an application you own or are authorized to inspect.
- Select a homepage request and record its method, hostname, path, and status.
- Perform a harmless search and identify which input changed.
- Find a body-bearing request and record its content type.
- Identify sensitive values that must be removed from any shared example.
Expected result: a traffic worksheet with synthetic or redacted values. If requests are missing, check that capture is active and filters are not hiding them.
Instructor example
A parameter named id could appear in a query string, form body, or JSON document. A rule scoped to one place may not apply elsewhere. Record the input's actual location before selecting a protection or exception.
Knowledge check
Why can a working HTTPS connection still provide no usable HTTP visibility to the WAF?
Instructor answer
Traffic may remain encrypted at the inspection point, or the selected deployment cannot decrypt that session. Establish the intended TLS architecture before troubleshooting payload rules.
Official reading
Independent training, not affiliated with Fortinet. Examples use an authorized isolated lab with synthetic data. The lab steps and expected outcomes have not been executed on a FortiWeb appliance for this publication. Firmware, platform, operating mode, licensing, and subscriptions affect behavior; follow the documentation for your exact build. References use 8.0.x examples and do not constitute an upgrade recommendation.
← Previous FortiWeb lesson · FortiWeb course guide · Next FortiWeb lesson →
Comments
Post a Comment