AWS WAF can now normalize queries before parsing, plus 10 new transformations!

Hey everyone, it's Shiichan! I found an AWS WAF update today and got so excited about it, so let me tell you all about it!

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New, AWS WAF now supports "pre-parse text transformations" as a new capability, along with 10 new text transformations you can use in any rule statement. Both are built with the same goal: letting AWS WAF normalize request content the same way your application actually interprets it before inspection.

The story so far

AWS WAF already had "text transformations" that let you apply processing like URL decoding, case conversion, or comment removal before a rule inspects a request. But these transformations only ran after AWS WAF had already parsed the query string into individual key-value pairs.

That left a gap. Attackers could manipulate the raw, unparsed query string itself so that AWS WAF and the backend application interpreted the same request differently. Think of HTTP Parameter Pollution (HPP), where duplicate parameter keys are sent, or tricks that exploit different interpretations of semicolons as delimiters. Post-parse transformations alone couldn't fully address evasion techniques that target the parsing step itself.

What changes

With the new pre-parse text transformations, AWS WAF can now normalize the raw query string before it gets split into key-value pairs. That closes evasion gaps rooted in parameter pollution and parser differentials.

You can chain up to 10 pre-parse transformations, and layer the existing post-parse text transformations on top within a single rule statement. In other words, you get a two-stage defense, normalize the raw string first, then parse it, then normalize the individual values, all configured in one rule.

On top of that, the 10 newly added text transformations are general-purpose and work for both pre-parse and post-parse use, so normalization logic you used to hand-roll with custom rules or separate tooling can now be handled with AWS WAF's standard settings alone.

Dive Deep

Pre-parse text transformations are available only when the inspected component is SingleQueryArgument or AllQueryArguments, and you configure them via the optional PreParseTextTransformations setting on the rule statement. If you don't specify one, the default is NONE, and the raw query string passes to the parser unmodified.

Here are some of the concrete transformations mentioned:

• URL decode (URL_DECODE) — decodes %HH-encoded sequences. Applying this before parsing can expose parameter boundaries that were previously hidden by encoding
• URL decode Unicode (URL_DECODE_UNI) — like the above, but also decodes %uHHHH-style Unicode escapes
• Combine Duplicate Query Arguments by Comma (COMBINE_DUPLICATE_QUERY_ARGS_BY_COMMA) — merges duplicate query parameter keys into a single comma-separated value at the first occurrence position, matching how backends such as .NET, API Gateway, and Express.js combine duplicate parameters into arrays
• Replace Semicolons with Ampersands (REPLACE_SEMICOLONS_WITH_AMPERSANDS) — replaces semicolons in the query string with ampersands, aligning AWS WAF's parsing with backends like AWS API Gateway REST APIs that treat semicolons as delimiters

Each of these is about matching inspection to how the backend actually interprets the request, a clear way to shut down evasion that exploits differences between parsers.

The 10 new text transformations span everything from industry-standard processing to specialized decoding:

• Uppercase, Trim, Remove Whitespace, and SHA256 are now available as standard, industry-common transformations
• The Amazon Threat Research Team also built operating-system-aware command line and JavaScript decoding functions. For example, where the existing CMD_LINE transformation applied generic, OS-agnostic command-line normalization, the newer variants account for the differences between Unix-style and Windows-style line endings, caret line continuations, and backslash handling, giving you normalization that better matches how each OS actually behaves

On pricing, each new text transformation (pre-parse or post-parse) consumes 10 WCUs, with no additional charge beyond standard AWS WAF pricing. It's available in all AWS Regions, so there's no need to worry about regional availability.

Wrap-up

• AWS WAF adds pre-parse text transformations, letting you normalize the raw query string before it's split into key-value pairs
• This helps close evasion gaps from HTTP Parameter Pollution and parser differentials
• You can chain up to 10 pre-parse transformations and layer them with existing post-parse transformations in a single rule statement
• 10 new text transformations arrive too, including industry-standard options like Uppercase, Trim, Remove Whitespace, and SHA256, plus OS-aware command line and JavaScript decoding built by the Amazon Threat Research Team
• Each new transformation costs 10 WCUs with no extra charge, and it's available in every AWS Region

If you're a security engineer building AWS WAF rules for query parameter inspection and worrying about parameter pollution or parser-differential evasion, this update is exactly for you.