> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/33/web-application-and-api-security-waas/waas-advanced-settings.md).

# Advanced settings

Advanced settings control various aspects of WAAS features.

<figure><img src="/files/F6I89MQUo1hvoxDVFw56" alt="waas advanced settings"><figcaption></figcaption></figure>

## Prisma Sessions

<figure><img src="/files/d5XfSLKjnxVLhfd620QQ" alt="waas prisma sessions"><figcaption></figcaption></figure>

Prisma sessions are intended to address the problem of "Cookie Droppers" by validating clients support of cookies and Javascript before allowing them to reach the origin server.

Once enabled, WAAS serves an interstitial page for any request that does not include a valid Prisma Session Cookie. The interstitial page sets a cookie and redirects the client to the requested page using Javascript.

A client that doesn’t support cookies and Javascript will keep receiving the interstitial page. Browsers can easily proceed to the requested page, and once they possess a valid cookie they will not encounter the interstitial page.

When you enable Prisma Session Cookies along with WAAS API protection, remember that APIs are often accessed by "primitive" automation clients. Avoid enabling Prisma Session Cookies on such endpoints unless you are certain all clients accessing the protected API endpoints support both cookies and Javascript. You can allow "primitive" clients by adding them as [user-defined bots](/admin-guide/33/web-application-and-api-security-waas/waas-bot-protection.md#user-defined-bot) and setting the bot action to `Allow`. Allowed [user-defined bots](/admin-guide/33/web-application-and-api-security-waas/waas-bot-protection.md#user-defined-bot) will not be served with an interstitial page and their requests will be forwarded to the protected application.

Prisma Session Cookies set by WAAS are encrypted and signed to prevent cookie tampering. In addition, cookies include advanced protections against cookie replay attacks where cookies are harvested and re-used in other clients.

## Ban

<figure><img src="/files/y5RePiYCkDRkK5gZxKt2" alt="waas ban settings"><figcaption></figcaption></figure>

Ban action is available in the `App firewall`, `DoS protection` and `Bot protection` tabs. If triggered the ban action prevents access to the protected endpoints of the app for a time period set by you (the default is set to 5 minutes).

If Prisma Session Cookies are enabled, you can apply the `ban` action by either `Prisma Session Id` or by IP address.

When the X-Forwarded-For HTTP header is included in the request headers, actions will apply based on the first IP listed in the header value (true client IP).

## Body Inspection

<figure><img src="/files/YRdhosusYAopRoTdF7ML" alt="waas body inspection"><figcaption></figcaption></figure>

Body inspection can be disabled or limited up to a configurable size (in Bytes).

WAAS body inspection limit is 131,072 Bytes (128Kb). WAAS protection is subject to one of the following actions when the body inspection limit exceeds:

* **Disable** - The request is passed to the protected application.
* **Alert** - The request is passed to the protected application and an audit is generated for visibility.
* **Prevent** - The request is denied from reaching the protected application, an audit is generated and WAAS responds with an HTML page indicating the request was blocked.
* **Ban** - Can be applied on either IP or Prisma Session IDs. All requests originating from the same IP/Prisma Session to the protected application are denied for the configured time period (default is 5 minutes) following the last detected attack.

To enable ban by Prisma Session ID, enable the Prisma Session Cookies in WAAS Advanced Settings.

## Remote Host

<figure><img src="/files/ghC4c9iXqhNJrLDvCzsH" alt="waas remote proxy"><figcaption></figcaption></figure>

This option is intended to defend web applications running on remote hosts which can not be protected directly by WAAS (for example, Windows Servers).

Remote host option is only available for WAAS host rules.

Use-case scenario:

1. A "middle-box" host instance with WAAS supported OS should be set up.
2. Traffic to the web application should be directed to the "middle-box" host.
3. Ports on the "middle-box" host to which traffic is directed to should be unused (WAAS will listen on these ports for incoming requests).
4. WAAS host rule with `Remote host` settings should be deployed to protect the "middle-box" host.
5. Incoming traffic to the "middle-box" host will be forwarded to the specified address (resolvable hostname or IP address) by WAAS.

WAAS sets the original `Host` HTTP header value in the `X-Forwarded-Host` HTTP header of the forwarded request. The `Host` header is set to the hostname or IP mentioned in the WAAS settings.

Use of TLS and destination port is determined by the endpoint configuration in the `App definition` tab.

Example:

The following protected endpoints are defined in the `App definition` tab:

<figure><img src="/files/DtPtRCrBcpVa6TSKxUX1" alt="waas forward example"><figcaption></figcaption></figure>

Remote host has been configured as follows:

<figure><img src="/files/yetqHsZXkdcCp6a2JyK0" alt="waas remote proxy example"><figcaption></figcaption></figure>

Expected result is as follows:

* HTTPS traffic to [www.example1.com](http://www.example1.com) on port 443 would be forwarded via HTTPS to [www.remotehost.com](http://www.remotehost.com)
* HTTP traffic to [www.example1.com](http://www.example1.com) on port 80 would be forwarded via HTTP to [www.remotehost.com](http://www.remotehost.com)

Protected endpoints with TLS enabled will not forward non-TLS HTTP requests.

Enter the host address without 'http' or 'https' string. For example, enter `www.example.com` and not <http://www.example.com>.

Enter the host address without 'http' or 'https' string. For example, enter "[www.example.com](http://www.example.com)" and not "<http://www.example.com>". Enter the host address without 'http' or 'https' string. For example, enter "[www.example.com](http://www.example.com)" and not "<http://www.example.com>".

## Customize WAAS Response Message

<figure><img src="/files/TADx0RkNttblHTI1ThRC" alt="waas custom response"><figcaption></figcaption></figure>

You can customize the response HTML and HTTP status code that are returned by WAAS when a **`Prevent`** or **`Ban`** effect occurs:

* **Prevent response code** - HTTP response code
* **Custom WAAS response message** - HTML code to be served. Click on image::waas\_preview\_HTML.png\[scale=10] for a preview of the rendered HTML code.

You can include Prisma Event IDs as part of customized responses by adding the following placeholder in user-provided HTML: `#eventID`.

User-provided HTML must start and end with HTML tags.

Javascript code will not be rended in the preview window.

## Prisma Event IDs

By default, responses sent to end users by WAAS are assigned an Event ID that may later be searched in the event monitor. An event ID is included in the response header **X-Prisma-Event-Id** and is also included in the default WAAS block message:

<figure><img src="/files/XorktdTZRcl4Q1ipkpdF" alt="waas eventid response"><figcaption></figcaption></figure>

You can include Prisma Event IDs as part of customized responses by adding the following placeholder in user-provided HTML: `#eventID`.

Prisma Event IDs can be referenced in WAAS Event Analytics using the `Event ID` filter:

<figure><img src="/files/PpclLAPBbjAii9luHHEj" alt="waas eventid filter"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/33/web-application-and-api-security-waas/waas-advanced-settings.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.