ALB WAF rule selectors reference

Work in progress: This page and the ALB WAF features are under active development. Supported selectors may still change before general availability.

This page enumerates every selector value that you can use inside a custom rule condition on the STACKIT Application Load Balancer Web Application Firewall (ALB WAF). It complements the Rule structure section of the ALB WAF features page, which explains how the selectors combine into a full rule.

The following diagram shows where the selectors on this page fit into the ALB WAF object model. An ALB listener attaches to a single ALB WAF configuration, which can reference at most one managed rule set (for example, the OWASP Core Rule Set) and at most one custom rule group. A custom rule group holds rules, and each rule contains one or more conditions built from the three selector kinds documented below.

A single condition inside a custom rule combines three selectors:

• A variable — the part of the HTTP transaction to inspect.
• Zero or more transformations — normalization steps applied to the variable before comparison.
• An operator — the comparison logic executed against the transformed variable.

Only the values listed on this page are accepted by the ALB WAF API. Coraza SecLang defines additional selectors that STACKIT does not expose today; requests using unsupported values are rejected at validation time.

Variables

A variable identifies which element of the HTTP transaction the condition inspects. Provide the variable as condition.variable.type in the API. For map-shaped variables (headers, cookies, arguments), you can further narrow the scope to a single key by setting condition.variable.value (for example, Host inside VARIABLE_REQUEST_HEADERS).

The following tables list every supported variable, grouped by the transaction side it targets.

Response

Variables in this group inspect data returned by your backend to the client. They are useful for detecting information disclosure or backend error patterns.

API constant	Value type	Description	Example
VARIABLE_RESPONSE_CONTENT_LENGTH	Integer	Contains the total length in bytes of the response body returned by the backend.	2048
VARIABLE_RESPONSE_HEADERS	Collection	Contains all HTTP header values returned from the backend to the client — for example, Cache-Control or Server.	no-cache, no-store (for Cache-Control)
VARIABLE_RESPONSE_HEADERS_NAMES	Collection	Contains the raw names or keys of all HTTP response headers sent by the backend — for example, Set-Cookie. Use this variable to inspect the header structure for anomalies.	Content-Type, Set-Cookie, Server
VARIABLE_RESPONSE_PROTOCOL	String	Contains the HTTP protocol version used by the backend for the response — for example, HTTP/1.1 or HTTP/2.	HTTP/1.1
VARIABLE_RESPONSE_STATUS	Integer	Contains the three-digit HTTP status code returned by the backend — for example, 200 or 404. Use this variable to build rules that trigger on backend errors to prevent data leakage.	500
VARIABLE_RESPONSE_BODY	String	Contains the raw or processed HTTP response body returned by the backend.	{"error":"internal server error"}

Request

Variables in this group inspect data sent by the client to your backend. They cover the request line, headers, cookies, and body.

API constant	Value type	Description	Example
VARIABLE_REQUEST_BASENAME	String	Contains only the filename part of the URI path — for example, index.php in /folder/index.php. Use this variable to protect specific file types or scripts against specific attack vectors.	login.php
VARIABLE_REQUEST_BODY	String	Contains raw or processed HTTP request body content — for example, POST form data, XML, or JSON payloads.	username=admin&password=secret
VARIABLE_REQUEST_BODY_LENGTH	Integer	Contains the total length in bytes of the HTTP request body.	512
VARIABLE_REQUEST_COOKIES	Collection	Contains all HTTP cookie values provided by the client.	abc123xyz (for session_id)
VARIABLE_REQUEST_HEADERS	Collection	Contains all HTTP header values from the request — for example, the User-Agent string or Host.	Mozilla/5.0 (X11; Linux x86_64) (for User-Agent)
VARIABLE_REQUEST_HEADERS_NAMES	Collection	Contains header names or keys — for example, Authorization or Content-Type — to target missing or modified headers.	Host, User-Agent, Authorization
VARIABLE_REQUEST_METHOD	String	Indicates the HTTP method used (for example, GET, POST). Useful for completely blocking specific methods on sensitive paths.	POST
VARIABLE_REQUEST_PROTOCOL	String	Indicates the HTTP protocol version used by the client — for example, HTTP/1.1 or HTTP/2.	HTTP/2
VARIABLE_REQUEST_URI_RAW	String	Contains the raw, non-normalized original URL — including the query string — exactly as transmitted to the load balancer. Use this variable to detect obfuscated specific attack vectors and evasion techniques in their raw state.	/search?q=%3Cscript%3Ealert(1)%3C/script%3E

Others

Variables in this group cover request arguments, transport-level attributes, and internal engine state exposed for rule authoring.

API constant	Value type	Description	Example
VARIABLE_ARGS_GET	Collection	A collection of all URL parameters and values (everything after the ?, for example, id=5 in index.php?id=5).	5 (for key id)
VARIABLE_ARGS_POST	Collection	Contains all parameters and values from the POST or PUT request body — for example, form data or API payloads.	admin (for key username)
VARIABLE_FULL_REQUEST_LENGTH	Integer	Contains the total HTTP request length in bytes — the sum of the request line, headers, and body. Use this variable to block denial-of-service (DoS) attempts through oversized requests.	4096
VARIABLE_MATCHED_VAR	String	Contains the exact value of the variable that triggered the rule. Use this variable to log the exact element responsible for the alert.	<script>alert(1)</script>
VARIABLE_QUERY_STRING	String	Contains the complete, raw URL query string after the ? — for example, search=cloud&sort=desc. Unlike VARIABLE_ARGS_GET, the string is evaluated as a whole instead of being split into individual keys or values.	search=cloud&sort=desc
VARIABLE_REMOTE_ADDR	String	Contains the IP address of the client or upstream proxy sending the request. Use this variable as the basis for IP allow-listing or to block malicious IP addresses.	203.0.113.42
VARIABLE_REMOTE_PORT	Integer	Contains the source port number used by the client for the load balancer connection.	54321

Operators

An operator defines how a transformed variable is compared against a provided value. Specify the operator in condition.operator.type and the comparison argument in condition.operator.value.

The following table lists the supported operators and their expected value types. Comparison operators (OPERATOR_EQ, OPERATOR_GE, OPERATOR_GT, OPERATOR_LE, OPERATOR_LT) treat both sides as integers.

API constant	Value type	Description	Example
OPERATOR_BEGINS_WITH	String	Returns true if the input starts with the parameter string.	/admin
OPERATOR_CONTAINS	String	Returns true if the parameter string appears anywhere in the input.	sqlmap
OPERATOR_ENDS_WITH	String	Returns true if the input ends with the parameter string.	.php
OPERATOR_EQ	Integer	Numeric equality. Returns true if the input value equals the parameter.	403
OPERATOR_GE	Integer	Numeric greater than or equal. Returns true if the input value is greater than or equal to the parameter.	500
OPERATOR_GT	Integer	Numeric greater than. Returns true if the input value is greater than the parameter.	1048576
OPERATOR_IP_MATCH	String	Matches an IPv4 or IPv6 address against a comma-separated list of individual IPs or CIDR ranges (for example, 192.168.1.0/24,10.0.0.5).	192.168.1.0/24,10.0.0.5
OPERATOR_LE	Integer	Numeric less than or equal. Returns true if the input value is less than or equal to the parameter.	100
OPERATOR_LT	Integer	Numeric less than. Returns true if the input value is less than the parameter.	10
OPERATOR_RX	String	Regular expression match using RE2 syntax. Supports up to nine capturing groups.	`(?i)(union.*select
OPERATOR_STREQ	String	Case-sensitive string equality. Returns true if the input string is identical to the parameter.	DELETE
OPERATOR_STRMATCH	String	Case-sensitive substring match. Returns true if the parameter appears anywhere in the input. Combine with TRANSFORMATION_LOWERCASE for case-insensitive checks.	<script>
OPERATOR_VALIDATE_SCHEMA	String	Validates the current request or response body against a JSON Schema. Returns true when the body violates the schema.	{"type":"object","required":["id"]}
OPERATOR_VALIDATE_URL_ENCODING	None	Returns true if the input contains malformed percent-encoded sequences (for example, non-hexadecimal characters after %).	(no value)
OPERATOR_VALIDATE_UTF8_ENCODING	None	Returns true if the input is not valid UTF-8, including malformed sequences and over-long encodings.	(no value)
OPERATOR_WITHIN	String	Returns true if the input value is found within the parameter (the parameter is the haystack, the input is the needle). Useful for allow-listing a set of literal values.	GET,HEAD,POST

Transformations

A transformation normalizes the variable before the operator runs. Provide transformations as an ordered list in condition.transformations; the engine applies them in the order given. Use TRANSFORMATION_NONE at the beginning of the list to make the pipeline explicit and avoid inheriting any default.

The following table lists every supported transformation.

API constant	Value type	Description
TRANSFORMATION_NONE	None	Clears any previously applied transformations. Use it as the first entry to guarantee a clean pipeline.
TRANSFORMATION_LENGTH	None	Replaces the input with its length in bytes as a string. For example, ABCDE becomes 5.
TRANSFORMATION_LOWERCASE	None	Converts all characters to lowercase.
TRANSFORMATION_UPPERCASE	None	Converts all characters to uppercase.
TRANSFORMATION_TRIM	None	Removes whitespace from both ends of the input.
TRANSFORMATION_UTF8_TO_UNICODE	None	Converts UTF-8 sequences to Unicode code points to normalize non-English input and reduce false positives and false negatives.

Ordering matters: Transformations run left to right, so ["TRANSFORMATION_LOWERCASE", "TRANSFORMATION_TRIM"] may produce a different result than ["TRANSFORMATION_TRIM", "TRANSFORMATION_LOWERCASE"] when the input contains whitespace inside case-sensitive tokens. Choose the order that matches the shape of the traffic you want to inspect.

Related pages

• ALB WAF features — how variables, operators, and transformations combine into a rule.
• Basic concepts of the ALB WAF — object model and life cycle.
• Coraza SecLang reference — upstream grammar. STACKIT exposes a subset through a structured JSON API.