Solving False Positives for Large File Uploads in Akamai WAF Without Compromising Security

Web Application Firewalls (WAFs) are designed to protect web applications by inspecting incoming requests for malicious payloads and abnormal behaviour. While these protections are essential, they can occasionally classify legitimate traffic as malicious, resulting in False Positives (FPs).

One such scenario occurred in our environment, where legitimate document uploads were being blocked by the Web Policy Violation attack group in Akamai WAF. This article walks through the challenge, the investigation, and the solution we implemented to eliminate the false positives while maintaining a strong security posture.

What Causes False Positives in Akamai WAF?

Our application provides users with the ability to upload large documents as part of its normal business workflow. During monitoring, we observed that these uploads were triggering a rule within the Web Policy Violation attack group, causing valid requests to be blocked.

From the application’s perspective, these uploads were expected and legitimate. However, from the WAF’s perspective, the request body exceeded the inspection threshold, resulting in the rule being triggered.

How We Investigated the Akamai WAF False Positive

The investigation focused on understanding why the rule was being triggered. The following steps were performed:

• Reviewed Akamai Security Events to identify the specific rule responsible for the blocks.
• Correlated the blocked requests with application logs to confirm they originated from legitimate users.
• Validated with the application owners that uploading large documents is an expected business requirement.
• Analysed the request sizes to determine whether the issue was caused by the inspection limit.

The findings confirmed that the WAF was behaving as designed — blocking requests whose payload size exceeded the configured inspection limit.

How to Reduce False Positives in Akamai WAF?

The first approach was to increase the maximum request body inspection size supported by Akamai WAF.

This significantly reduced the number of false positives; however, some legitimate uploads continued to exceed the maximum inspection limit and were still blocked.

Although increasing the inspection limit helped, it did not completely resolve the issue.

Why a Simple Path-Based WAF Exception Was Not the Right Choice

At first glance, creating a path-based exception for the upload endpoint appeared to be the simplest solution — for example, excluding requests sent to /upload.

However, this approach introduced a significant security concern.

By excluding the entire upload path from the Web Policy Violation rule, every request to that endpoint — including malicious requests — would bypass inspection by that rule. Attackers could potentially exploit the upload functionality to deliver malicious payloads that would no longer be inspected, increasing the likelihood of False Negatives (FNs).

A Granular, Risk-Based Solution for Akamai WAF

Instead of completely bypassing the WAF rule, we implemented a targeted exception based on multiple conditions. The exception is applied only when:

• The request is sent to the designated document upload endpoint.
• The source request originates from an expected and trusted Autonomous System Number (ASN).
• The exception applies only to the specific Web Policy Violation rule generating the false positives.

Only when all these conditions are met is the request exempted from that particular rule. All other WAF protections continue to inspect the request as normal.

Requests arriving on the same upload endpoint from untrusted ASNs continue to be fully inspected, and blocked if malicious activity is detected.

Why ASN-Based Scoping Improves WAF Security

Restricting the exception to known customer or partner ASNs significantly reduces the attack surface. Instead of trusting every request sent to the upload endpoint, only traffic originating from expected networks benefits from the rule-specific exception.

This approach provides a much stronger security posture compared to a blanket path exclusion.

Security Benefits of Granular WAF Rule Tuning

The implemented solution offers several advantages:

• Eliminates false positives for legitimate large file uploads.
• Preserves inspection by all other WAF attack groups.
• Avoids exposing the upload endpoint through a broad exception.
• Reduces the risk of false negatives by limiting the exception to trusted source ASNs.
• Follows the principle of least privilege by creating the smallest possible exception required to support the business.

WAF monitoring, policy optimization, and expert rule tuning can help maintain the right balance between security and business functionality.

How WAF Managed Services Experts Help Optimize WAF Security

At Mudals Technologies, our WAF managed services experts help organizations manage, monitor, and optimize their Web Application Firewall environments.

Our team focuses on precise WAF rule tuning, false positive analysis, security policy optimization, and granular exception management. This approach helps organizations allow legitimate business traffic without unnecessarily weakening their security controls.

Our WAF security expertise can support environments using Akamai WAF and AWS WAF, helping organizations continuously optimize WAF policies based on application requirements, security events, and changing business needs.

Conclusion

Resolving false positives requires more than simply allowing blocked traffic. The goal is to minimise operational impact while preserving the effectiveness of the WAF.

In this case, increasing the inspection limit alone was insufficient. Rather than weakening security through a broad path-based exception, we implemented a tightly scoped exception that combined the upload path with trusted ASN validation. This approach successfully restored legitimate business functionality while maintaining robust protection against malicious traffic.