Section – HTTP Parameter Pollution Detection - same type

This feature prevents HTTP parameter pollution attempts using duplicate parameters with the same type. Parameter names are treated case-insensitively. For instance, this is the case if the same parameter is added multiple times as a POST parameter. The following parameter types are distinguished:

  • Query parameters
  • Path segment parameters
    • A path segment can contain one or more parameters, each introduced by a semicolon (;). For example, /⁠test;name=value;name2=value2/test2 contains the parameters name=value and name2=value2 in the same path segment.
  • Additional query parameters for encrypted URLs.
  • POST parameter

GUI

Description

Join values of duplicate parameters

If enabled, all the different values for a parameter are joined by commas in order of appearance. The aggregate value is then checked against deny rules as if it had been submitted as an original value by the client.