AWS::WAFv2::WebACL XssMatchStatement

A rule statement that inspects for cross-site scripting (XSS) attacks. In XSS attacks, the attacker uses vulnerabilities in a benign website as a vehicle to inject malicious client-site scripts into other legitimate web browsers.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{
  "FieldToMatch" : FieldToMatch,
  "TextTransformations" : [ TextTransformation, ... ]
}

YAML

  FieldToMatch: 
    FieldToMatch
  TextTransformations: 
    - TextTransformation

Properties

FieldToMatch

The part of the web request that you want AWS WAF to inspect.

Required: Yes

Type: FieldToMatch

Update requires: No interruption

TextTransformations

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. If you specify one or more transformations in a rule statement, AWS WAF performs all transformations on the content of the request component identified by FieldToMatch, starting from the lowest priority setting, before inspecting the content for a match.

Required: Yes

Type: Array of TextTransformation

Minimum: 1

Update requires: No interruption