demo: waf custom rule → geo block (US)
a waf custom rule blocks any request from a US ip address on this endpoint. if you are in the US, you'll see the branded 403 block page. if you are outside the US, the endpoint returns 200 with your detected country. test both by hopping on a vpn.
# trigger the geo rule
the button below fires fetch('/api/geo-check'). the waf rule
also matches on the raw path /waf-geo-block, so a full-page
navigation there will show the branded 403 directly.
click a button…
# or from your terminal
# from a US ip → 403 branded block page
curl -i "https://rhocfsandbox.com/api/geo-check"
# from a non-US ip → 200 with detected country
curl -s "https://rhocfsandbox.com/api/geo-check" | jq# what's the rule
| rule name | SITE_waf_geo_us_block |
| expression | (http.request.uri.path eq "/api/geo-check" or http.request.uri.path eq "/waf-geo-block") and ip.geoip.country eq "US" |
| action | block · custom html response (403) · message includes country |