ATO:195 Amend WAF query param limit

[ethanmills]

What?

Amend WAF query param limit

Why?

The authorize request from orchestration exceeds the limit imposed by this WAF rule. Maintain for all other endpoints, but extend to 4096 for the authorize endpoint.

Related PRs

govuk-one-login/authentication-api#3563

[sebibo]

There are two main issues with this -

1. unlimited url & query parameters will allow an attacker to perform a denial of service attack by passing through very large URLs that are no longer dropped by the WAF, consuming all the resources -
   https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/
2. Additional parameter length will allow for additional information to potentially be leaked to an attacker https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url

[sebibo]

Primary concern is the increased likelihood of a denial of service impact of the proposed change - global changes to the WAF for accounts would affect all the APIs not just the specific API which has the issue.

From a security perspective the recommendation would one of the following presented in preferred order:

1. reduce the query size to be under 2000 characters
2. create a specific rule for the single API call affected
3. increase the rate limit for all API calls - but by the smallest amount possible

[billrdunn]

LGTM