WAF
A Web Application Firewall (WAF) filters, monitors, and blocks HTTP traffic to and from a web application. It protects against common attacks like SQL injection, XSS, and DDoS by inspecting and filtering HTTP requests.
§ 1 Definition
A WAF is a security appliance (hardware, software, or cloud-based) that sits between a web application and the internet, inspecting all incoming HTTP/HTTPS traffic. It applies a set of rules (often based on the OWASP ModSecurity Core Rule Set) to detect and block malicious requests. WAFs can operate in positive security model (allow only known-good traffic) or negative security model (block known-bad patterns). Modern cloud WAFs (Cloudflare, AWS WAF, Akamai, Imperva) offer managed rule sets, bot detection, rate limiting, and DDoS protection alongside traditional WAF capabilities.
§ 2 How WAF Works
A WAF intercepts every HTTP request before it reaches the application server. It parses the request and evaluates it against configured rules. Rules can inspect the URL path, query parameters, headers, body content, IP address, request rate, and other attributes. When a request matches a rule, the WAF can block, log, challenge (CAPTCHA), or rate-limit it. WAFs operate at Layer 7 (application layer) of the OSI model, differentiating them from network-level firewalls that operate at Layers 3 and 4.
§ 3 Managed vs Custom Rules
Managed rule sets: Pre-built, regularly updated rules maintained by the WAF provider. The OWASP ModSecurity Core Rule Set (CRS) is the most popular open-source option. Cloud providers offer their own managed rules (AWS WAF Managed Rules, Cloudflare WAF Managed Rules). Custom rules: User-defined rules tailored to specific applications, such as blocking requests to specific paths, allowing only certain countries, or blocking requests with specific headers. A defense-in-depth approach uses both.
§ 4 WAF Limitations
WAFs are not a substitute for secure coding. A WAF can detect known attack patterns but can be bypassed by novel or obfuscated payloads. False positives are common: legitimate traffic gets blocked, requiring ongoing rule tuning. WAFs add latency to every request. They do not protect against business logic vulnerabilities, broken authentication, or authorized insider threats. WAF is a compensating control, not a silver bullet.
§ 5 Note
§ 6 Common questions
- Q. Do I need a WAF if I write secure code?
- A. Defense-in-depth says yes. A WAF provides protection against zero-day vulnerabilities, known-vulnerability scanning, and traffic-based attacks (DDoS, credential stuffing) that secure code alone does not address. But it does not replace secure coding.
- Q. What is the OWASP Core Rule Set?
- A. The ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for WAFs. It provides protection against SQL injection, XSS, LFI, RFI, and many other attack categories. It is open source and widely deployed with ModSecurity, NGINX, and cloud WAFs.
- Q. Can a WAF protect against DDoS?
- A. Yes, many cloud WAFs include DDoS protection. They can absorb and filter large volumes of malicious traffic before it reaches your origin server. Rate limiting and bot detection are common WAF features.
- WAF filters HTTP traffic to block common web attacks.
- Cloud WAFs offer managed rule sets, bot detection, rate limiting, and DDoS protection.
- WAF is a compensating control, not a replacement for secure code.
- Regular rule tuning is required to reduce false positives and bypasses.
Atomic Glue deploys and configures WAFs with managed and custom rule sets as part of our infrastructure hardening service. We tune rules to minimize false positives. Trust & Security.
Get in touchA Web Application Firewall (WAF) filters, monitors, and blocks HTTP traffic to and from a web application. It protects against common attacks like SQL injection, XSS, and DDoS by inspecting and filtering HTTP requests.
Category: Security (also: Infrastructure)
Author: Atomic Glue Security Team
## Definition
A WAF is a security appliance (hardware, software, or cloud-based) that sits between a web application and the internet, inspecting all incoming HTTP/HTTPS traffic. It applies a set of rules (often based on the OWASP ModSecurity Core Rule Set) to detect and block malicious requests. WAFs can operate in positive security model (allow only known-good traffic) or negative security model (block known-bad patterns). Modern cloud WAFs (Cloudflare, AWS WAF, Akamai, Imperva) offer managed rule sets, bot detection, rate limiting, and DDoS protection alongside traditional WAF capabilities.
## How WAF Works
A WAF intercepts every HTTP request before it reaches the application server. It parses the request and evaluates it against configured rules. Rules can inspect the URL path, query parameters, headers, body content, IP address, request rate, and other attributes. When a request matches a rule, the WAF can block, log, challenge (CAPTCHA), or rate-limit it. WAFs operate at Layer 7 (application layer) of the OSI model, differentiating them from network-level firewalls that operate at Layers 3 and 4.
## Managed vs Custom Rules
**Managed rule sets**: Pre-built, regularly updated rules maintained by the WAF provider. The OWASP ModSecurity Core Rule Set (CRS) is the most popular open-source option. Cloud providers offer their own managed rules (AWS WAF Managed Rules, Cloudflare WAF Managed Rules). **Custom rules**: User-defined rules tailored to specific applications, such as blocking requests to specific paths, allowing only certain countries, or blocking requests with specific headers. A defense-in-depth approach uses both.
## WAF Limitations
WAFs are not a substitute for secure coding. A WAF can detect known attack patterns but can be bypassed by novel or obfuscated payloads. False positives are common: legitimate traffic gets blocked, requiring ongoing rule tuning. WAFs add latency to every request. They do not protect against business logic vulnerabilities, broken authentication, or authorized insider threats. WAF is a compensating control, not a silver bullet.
## Note
WAF bypass techniques exist. Attackers use encoding, parameter pollution, case variation, and HTTP verb tampering to evade signatures. Regular rule updates and custom tuning are essential.
## Common questions
Q: Do I need a WAF if I write secure code?
A: Defense-in-depth says yes. A WAF provides protection against zero-day vulnerabilities, known-vulnerability scanning, and traffic-based attacks (DDoS, credential stuffing) that secure code alone does not address. But it does not replace secure coding.
Q: What is the OWASP Core Rule Set?
A: The ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for WAFs. It provides protection against SQL injection, XSS, LFI, RFI, and many other attack categories. It is open source and widely deployed with ModSecurity, NGINX, and cloud WAFs.
Q: Can a WAF protect against DDoS?
A: Yes, many cloud WAFs include DDoS protection. They can absorb and filter large volumes of malicious traffic before it reaches your origin server. Rate limiting and bot detection are common WAF features.
## Key takeaways
- WAF filters HTTP traffic to block common web attacks.
- Cloud WAFs offer managed rule sets, bot detection, rate limiting, and DDoS protection.
- WAF is a compensating control, not a replacement for secure code.
- Regular rule tuning is required to reduce false positives and bypasses.
## Related entries
- [SQL Injection](atomicglue.co/glossary/sql-injection)
- [XSS](atomicglue.co/glossary/xss)
- [DDoS Protection](atomicglue.co/glossary/ddos-protection)
- [Security Headers](atomicglue.co/glossary/security-headers)
Last updated December 2024. Permalink: atomicglue.co/glossary/waf