Section – HTTP Parameter Pollution Detection

This feature prevents HTTP parameter pollution attempts using duplicate parameters with the same name but different types. Parameter names are treated case-insensitively. The following parameter types are distinguished:

Query parameters
Path segment parameters
- A path segment can contain one or more parameters, each introduced by a semicolon (;). For example, /⁠test;name=value;name2=value2/test2 contains the parameters name=value and name2=value2 in the same path segment.
Additional query parameters for encrypted URLs.
POST parameter

GUI	Description
Block duplicate parameters	If enabled, requests are blocked when the same parameter name is used across different parameter types — e.g., a request is blocked if the parameter `id` is present both as a POST parameter and as a query parameter.
Log only	If enabled, threat handling for duplicate parameters is set to log only instead of blocking.
Parameter name exception pattern	Use the exception pattern to exclude parameters from the parameter pollution detection.