OWASP CRS-style SQL rules can match benign query strings on static files — for example GET /app.js?v=1' OR '1'='1. That is often a false positive, not a real SQL injection against your API.
What the product does
WafFalsePositiveDetector identifies likely false positives on static extensions (.js, .css, .map) for SQL/CRS-related rules. The UI shows a likely false positive badge, and attack metrics exclude these events from counts.
At the engine level, a scoped skip reduces SQL rule evaluation on GET/HEAD requests to static asset paths. This is narrow by design.
What it does not do
- Does not turn off SQLi detection globally
- Does not skip inspection on API endpoints (
/api/*, POST bodies, etc.) - Does not guarantee zero tuning — unusual API paths may still need analyst review
SOC guidance
- Check the virtual directory column — confirm the path is truly a static asset
- If labeled likely false positive on
.js/.css, prioritize real API alerts first - For persistent noise on dynamic routes, use IP/UA exceptions or detect-only on specific modules — not global disable
- Geo Traffic Wall excludes labeled false positives from attack counts — do not interpret low geo counts as “no attacks” without checking raw logs
Auditor note: Scoped static skip is a tuning optimization with visible labeling — not a silent bypass of SQL protection on application APIs.