Web Application Firewall (WAF) configuration for Jira-Bitbucket integration

[Michaël GENAY]

Hi,

We have Jira and Bitbucket DataCenter On-Premises.

Our security team requires that a WAF be placed in front of our BitBucket servers, filtering data coming from Jira (Bitbucket and Jira behing hosted in a different security zones).

Is there configuration guidelines, or can you please help us identify the right rules :

- Application language
- Allowed parameters, headers length
- Any whitelisting for parameters
- Response status codes
- Anything else :)

Best regards

[Mirek]

Hi @Michaël GENAY 

Adding WAF in front of an application is always good but "tricky". Good WAF knows applications and not block things that should not be blocked and does not create many false-positives..

I do not think that there is a standard set of rules that you can simply grab and use in WAF. There should be some default database that is updated all the time with new rules..

Bitbucket is a please to store code and if code it means that WAF would treat this more often as a problem and block it.. I suggest to simply try things out and if any problem work very closely with security team to identify what is a safe request what is not and modify exceptions.

I remember that when we introduced WAF many basic features where not working like search in JIRA or edit page in Confluence :).. but after some time when we tested.. we reduced number of false-positives and now do not see many problems.

[AliMAHMOODI]

@Mirek 

Hi;

I recently add WAF in front of jira and it seams search feature is now working. I'm not expert in WAF and not too much experience doing this, I just followed some guides for this. My question is that I must disable the rule(s) that is blocking the request for that URI?\

Thanks for your help.

[Mirek]

Yes, when something is not working you have to identify the request and response. Depends on your WAF software you should get an ID od something in the response that would be reference to the blocking event.. Then on WAF side you have to add an exception to that request and check if that helped.