Web Application Firewalls and Edge Protection

A WAF inspects HTTP requests and blocks those matching attack signatures (OWASP Core Rule Set: SQLi, XSS, path traversal, scanners), custom rules (block admin paths from the internet, geofencing) and virtual patches for known CVEs. Deploy at the edge (Cloudflare, AWS WAF, Akamai, Fastly) or as a module (ModSecurity/Coraza). Start in detection/count mode, tune false positives with exclusions, then block. Edge networks also absorb DDoS traffic. A WAF complements — never replaces — secure code.

# Example AWS WAF approach (conceptual)
1. Managed rule groups: Core rule set, Known bad inputs, SQLi, IP reputation      (COUNT mode first)
2. Rate-based rule: 1,000 requests / 5 min per IP on /api/auth/*                   (BLOCK)
3. Custom rule: block /admin/* unless source IP in office/VPN set                 (BLOCK)
4. Review logs for false positives → add scoped exclusions → switch groups to BLOCK
5. Virtual patch for a CVE in a vendored library until the upgrade ships

Common pitfalls

• Turning on blocking without tuning (breaking legitimate traffic).
• Assuming a WAF makes vulnerable code safe.
• Origin servers reachable directly, bypassing the edge (lock down origin access).

Key points

• Signatures, custom rules, virtual patches
• Count → tune → block
• Lock origins to the edge

Further reading: OWASP Core Rule Set