Input exclusions
One type of an application exclusion is an input exclusion. These exclusions let you exclude specific inputs from a Contrast agent's analysis. This exclusion type can be useful if you know certain inputs are safe and do not require monitoring, thereby reducing noise in your security reports.
Types of input exclusions
Contrast supports exclusions that use these types of inputs:
Parameter: Excludes specific parameters accessed through request methods, including parameters from the post body or query string itself.
Header: Excludes specific HTTP headers.
Query String: Excludes the entire query string.
Body: Excludes the entire request body.
Cookie: Excludes specific cookies.
Parameter Input exclusions
An input exclusion with an input type of parameter checks for any parameters in the request, like those from the query string or form body, that match the specified parameter, as long as the application retrieves it using that parameter name (for example, request.getParameter("foo")).
Example:
If you specify foo as the parameter to exclude, the following table shows examples of how Contrast handles the HTTP request.
HTTP request | If excluded... | If included... |
|---|---|---|
| Contrast excludes this parameter from monitoring:
| Contrast continues to monitor this parameter:
|
NoteFor a POST request, the exclusion only works for a body format of | Contrast excludes this parameter from monitoring:
| Contrast continues to monitor this parameter:
|
Header input exclusions
Headers are specific HTTP headers that the application retrieves from the request (for example, request.getHeader("User-Agent")).
Example:
If you specify User-Agent as a header to exclude, the following table shows examples of how Contrast handles HTTP requests.
HTTP request | If excluded... | If included... |
|---|---|---|
| Contrast excludes this header from monitoring:
| Contrast continues to monitor this header:
|
Query string input exclusions
The query string exclusion applies to the entire query string, not individual parameters. This exclusion is useful when the application retrieves and parses the entire query string (for example, acting on the result of request.getQueryString()).
Example:
Based on specified URLs, the following table shows examples of how Contrast handlws HTTP requests.
HTTP request | If excluded... | If included... |
|---|---|---|
| Contrast excludes the entire query string from monitoring | Contrast continues to monitor the entire query string |
Body input exclusions
The body input exclusion applies to the entire body of the request. This type of exclusion is useful when the body contains data that the application parses (for example, acting on the result of request.getBody())
Example:
Based on specified URLs, the following table shows examples of how Contrast handles HTTP requests.
HTTP request | If excluded... | If included... |
|---|---|---|
| Contrast excludes the entire request body from monitoring | Contrast continues to monitor the entire request body |
Cookie input exclusions
Cookie input exclusions are useful when you want to suppress findings related to specified cookies.
Example:
If you specify sessionID as the cookie to exclude, the following table shows examples of how Contrast handles HTTP requests.
HTTP request | If excluded... | If included... |
|---|---|---|
| Contrast excludes this cookie from monitoring:
| Contrast continues to monitor this cookie:
|