Security tab¶
The Security tab contains configuration options that affect the security level and specify security-related features in more detail.
The following settings are available:
| Name | Definition |
|---|---|
| Block IP Addresses Not on the Allow List | Enables or disables blocking of IP addresses that are not on the list of allowed IP addresses.NoteYou can use blocking of IP addresses that are not on the allow list for targeted user selection, for example for beta testing or developer environments with a restricted user base. You can find the IP allow list under DOMAINS → SUBDOMAINS → IP Allow / Blocklist.Default value: Off |
| Block traffic from TOR network | Enables or disables blocking of traffic from the Tor network. Default value: Off |
| Antibot | Enables or disables Antibot module from Myra. The antibot module from Myra automatically detects and excludes bots. Various security mechanisms can be used to make a distinction between bots and valid users, for example through the frequency and sequence of requests. So the bots are excluded, and valid users are not affected.NoteIn case of severe attacks, Myra reserves the right to activate this option for defense purposes.Default value: Off |
| Antibot threshold ratio | Defines the threshold value for requests per minute sent to your infrastructure. If the value is exceeded, Myra activates the Antibot module.NoteThis value is the ratio between the direct requests sent to the customer infrastructure and the cached requests. In some DDoS attack types, attackers target large, non-cacheable resources to overload the customer infrastructure. This setting is used to automatically detect and defend against such attacks.Default value: 1800 |
| Block AI bots | Enables or disables the blocking of AI bots and AI crawlers to protect your web content from them.NoteThe list of AI bots is regularly expanded. Contact Myra Support or Customer Success Management for an up-to-date list of AI bots that Myra has blocked.Default value: Off |
| POST flood detection using JavaScript | Enables or disables the detection of POST floods by using a JavaScript-based puzzle. Default value: Off |
| POST flood detection frequency | Defines the value for determining the frequency of the JavaScript-based puzzle. The higher the value, the less frequently the puzzle has to be solved. Default value: 540 |
| HTTP Strict Transport Security (HSTS) | Defines the time period in seconds during which only HTTPS-encrypted connections are permitted. Default value: Off |
| HSTS max-age directive | Defines the time period in seconds during which only HTTPS-encrypted connections are permitted. Default value: 31536000 |
| HSTS includeSubDomains directive | Enables or disables extending the HSTS protection to all subdomains. Default value: Off |
| HSTS preload directive | Enables or disables adding the domain to the HSTS preload list (hstspreload.appspot.com).Default value: Off |
| DHE key length | Defines the length of the Diffie-Hellman key exchange parameter in bits.NotePlease note that Java 6 and 7 do not support a parameter larger than 1024 bits.Default value: 2048-bit |
| Origin SNI | Enables or disables the Server Name Indication (SNI) of the customer infrastructure. Default value: On |
| WAF | Enables or disables the Web Application Firewall (WAF).NoteThe Web Application Firewall (WAF) can only be used if you have purchased it. This option is greyed out if you have not purchased the WAF.NoteFor complete activation, you must add in the WAF view or Tags view at least one WAF rule or copy a preconfigured Myra Tag. See Section Set up Myra WAF.Default value: On |
| WAF hierarchy | Defines at which level the WAF rules are executed. The following options are available:
|
| WAF default policy | Defines whether, as part of the default policy for missing WAF rules, all requests are allowed or blocked. Default value: Allow |
| Myra Authentication to Origin (Certificate) | An SSL/TLS certificate (and chain) is used to make requests to the customer infrastructure. Alternatively, an existing certificate can be used as the default value. Default value: Not available |
| Myra Authentication to Origin (Certificate Key) | Includes the private key for the SSL/TLS certificate. Alternatively, an existing private key can be used as the default value. Default value: Not available |
| TLS Versions Used | Defines which TLS connections should be used. The following values are available:
|
| Allowed HTTP Request Methods | Defines which HTTP request methods are allowed. The following values are available:
|
| Verify Client Certificates | Enables or disables verification of client certificates (mTLS). Default value: Off |
| Trusted Certificate for Client Certificate Verification | Includes a file with trusted CA certificates in PEM format that are used to verify client certificates. Alternatively, an existing certificate can be used as the default value. Default value: Not available |
| Header name for Certificate Verification Status | Defines the name of the header that contains the SSL/TLS verification status. Default value: X-MYRA-SSL-VERIFIED |
| Header name for Client Certificate Fingerprint | Defines the name of the header that contains the fingerprint of the client certificate used. Default value: X-MYRA-SSL-Fingerprint |