Web Application Firewall
A WAF checks web requests against rules. It can filter unwanted traffic, but needs suitable settings and does not replace fixing errors in code.
What does WAF mean?
A Web Application Firewall (WAF) checks requests to web applications. It can filter unwanted traffic using request properties and rules. Cloudflare describes, for example, checks of paths, headers and request content. The scope and possible actions depend on the solution used.
Example: adding protection to an upload form
In a fictional portal, a WAF sits in front of the upload endpoint. The team checks the rules with permitted uploads and unwanted requests. It must also be able to identify normal customer operations being blocked by mistake.
An exception should address the affected workflow specifically. Broadly disabling inspection can let other, still unwanted requests through. Rule changes therefore need clear reasons and subsequent functional checks.
The WAF replaces neither input validation and safe processing in the application nor its permission checks. A vulnerability identified in code remains a separate task, even when a filter rule makes a particular attack more difficult.
Sources
Related terms
- Hypertext Transfer ProtocolHTTP governs requests and responses between client and server. The method, status and content must fit the agreed application behaviour.
- Reverse proxyA reverse proxy accepts requests in front of an application and forwards them. Routing, connection boundaries and forwarded information need clear rules.
- FirewallA firewall controls network traffic according to rules. An allowed connection replaces neither secure software nor permission checks within the application.
- Return-PathReturn-Path records the SMTP reverse path in a header. It explains the technical route for error reports, not a person’s identity.
- Envelope-FromEnvelope-From identifies the SMTP sender for transport and error feedback. It must be distinguished from the visible sender address.
- DMARC aggregate reportA DMARC aggregate report summarises a reporting mail system’s domain checks over a period. It helps examine sending sources and misconfigurations.
Articles on this topic
Cloud & Operations with ASES
Hosting, deployment, maintenance and support