3

I want to increase the security of one of our Magento2 installations by filtering GET parameters. It seems that, according to our WAF, especially "filter" parameters are often tried to be exploited; for example:

/sweets/candies/natural-flavours.html?product_filter_tryout=1133%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%23

This happens, no matter if filters are used on the website or not. I therefore want to block all requests to ?product_filter_tryout*, or better whitelist all actually used parameters on the site (like ?p=* etc.). How can I achieve this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.