Web Application Firewall (WAF)
An application-layer firewall that inspects HTTP requests for attacks — real value against common exploits, real limits against determined attackers, and a false-positive budget to manage.
What is a WAF?
A Web Application Firewall sits in front of web apps and APIs, inspecting HTTP requests at layer 7 — headers, body, query strings — and blocking those matching attack patterns: SQL injection strings, XSS payloads, path traversal, known-bad bots, and volumetric floods via rate rules. Unlike a network firewall reasoning about ports and IPs, a WAF understands requests, which is the only layer where application attacks are visible.
What it genuinely buys — and doesn’t
A WAF is a strong outer layer: managed rule sets (AWS WAF, Cloudflare, the OWASP Core Rule Set) block the constant background radiation of automated exploit attempts and buy time to patch a freshly disclosed CVE (virtual patching — a WAF rule blocking the exploit pattern while you fix the code). What it is not is a substitute for secure code: WAFs are bypassable by determined attackers through encoding tricks and novel payloads, and they see nothing of business-logic flaws (broken authorization, IDOR, price manipulation) because those are valid-looking requests. Treat the WAF as defense in depth, never as the reason the app can be insecure.
Operating one without breaking production
The defining operational tension is false positives — a rule that blocks SQL-injection patterns will eventually block a legitimate user whose input looks adversarial (the classic: a form field containing ' OR). The disciplined rollout: run rules in count/monitor mode first, watch what they’d block against real traffic, tune, then enforce. Layer rate limiting on authenticated and expensive endpoints (search, LLM inference), not just the homepage — that’s where abuse concentrates.
What people get wrong
- Enforce-first deployment that blocks real customers on day one and burns trust in the tool.
- WAF as the security program: it’s one layer; injection defense belongs in parameterized queries, authz in the app.
- Set-and-forget rules — attack patterns and your own app evolve; unreviewed rules drift into both gaps and false positives.
Primary source: OWASP — Web Application Firewall
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.