AWS waf medium security documentation change
Summary
Clarified WAF rule evaluation logic when headers are missing, including NOT statement behavior.
Security assessment
Changes security-relevant rule evaluation logic by altering how missing headers are handled. Incorrect configurations could lead to unintended allow/block decisions, making this a security documentation update.
Diff
diff --git a/waf/latest/developerguide/waf-rule-statement-forwarded-ip-address.md b/waf/latest/developerguide/waf-rule-statement-forwarded-ip-address.md index 23a8ba72d..1d96c2d59 100644 --- a//waf/latest/developerguide/waf-rule-statement-forwarded-ip-address.md +++ b//waf/latest/developerguide/waf-rule-statement-forwarded-ip-address.md @@ -32 +32 @@ You can instruct AWS WAF to use a forwarded IP address for any of these rule sta -If the header that you specify isn't present in the request, AWS WAF doesn't apply the rule to the web request at all. +If a header is missing, AWS WAF evaluates any statement that uses that header as "No match." If you use a NOT statement with a "No match" result, AWS WAF converts the evaluation to "Match." Missing headers don't trigger fallback behavior - only invalid header values do.