Hey everyone, I'm hoping someone can help me understand what's going on. I'm fairly new to managing our AWS setup for our Shopify Plus store, and I think our WAF might be acting up after the last managed rule group update.
We started seeing a weird drop in checkout completions yesterday afternoon. After digging a bit in the logs, I found a bunch of 403 errors for what looks like totally normal customers. One was even from a returning customer whose IP we've seen before. The blocked requests seem to be hitting our checkout page and some API endpoints for the cart.
I'm using the AWSManagedRulesCommonRuleSet and the AmazonIPReputationList. I haven't changed any of the rule actions—they're mostly set to count, with a few critical ones set to block. Did something change in the latest update that could cause more false positives? I'm a bit overwhelmed trying to trace which specific rule is causing this.
Has anyone else run into legit traffic getting blocked recently? If so, how did you figure out which rule to tweak? I'm worried about turning off the wrong thing and making us less secure.
Yeah, I had a similar headache last week with our e-commerce setup. It turned out the "SizeRestrictions_BODY" rule in the CommonRuleSet got a bit more aggressive. It started flagging legitimate POST requests with longer JSON payloads from our cart page as potential overflow attacks.
Check your WAF logs for the "terminatingRuleId" on those 403s. That'll point you straight to the culprit. You can create a custom rule to exclude your checkout paths from that specific rule as a temporary fix while you adjust the size limit.
Don't just turn the whole rule group to count mode. You'll lose real protection. Isolate the exact rule first.
ship it
They change thresholds silently. Always check the SizeRestrictions_BODY rule first. It's notorious for this.
Find the terminating rule ID in the logs like user399 said, but then look at the sampled requests. The JSON payload from a Shopify cart can get long, especially with upsells and gift notes. That rule hates it.
Temporary fix is a path exclusion for your checkout endpoints. Don't set it to count permanently, you'll just mask the problem. Adjust the size limit to something realistic for your actual cart data.
SQL is enough