PaaS only

How to bypass WAF for GraphQL requests

Last update: May 8, 2024

This article explains how to bypass WAF for GraphQL requests when the Fastly WAF is blocking your GraphQL requests.

Affected products and versions

Adobe Commerce on cloud infrastructure (all versions)

Cause

Due to the inherent nature of GraphQL requests, there can be a lot of repeated characters that can trigger false positive blocking of the requests by the Fastly WAF.

Solution

  1. Bypass the WAF for these requests by adding a custom snippet through the Fastly Magento module:

    type: recv
    priority: 15
    content:

    if( req.url.path ~ "^/graphql" ) {
    set req.http.bypasswaf = "1";
}

  2. Click on Upload VCL to Fastly.

recommendation-more-help