TOPIC SECURITY
WAF filtering malicious traffic before it reaches your application
IN 10 SECONDS
A Web Application Firewall (WAF) inspects HTTP/HTTPS traffic at the edge and blocks common attacks — SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and OWASP Top 10 threats. AWS WAF, Cloudflare WAF, and ModSecurity allow you to write custom rules to block or rate-limit specific patterns, IPs, or geographies.
GOTCHA WAFs can produce false positives — blocking legitimate traffic because it happens to match a rule pattern. Always test new WAF rules in logging mode first, review the blocked requests, and whitelist known-good patterns before switching to block mode.
HOW A WAF BLOCKS AN ATTACK
01 Attacker sends `GET /products?search=1' OR '1'='1' --` — a classic SQL injection attempt.
02 WAF receives the request at the edge (before it reaches your origin). It inspects headers, query strings, and body.
03 Rule engine matches the payload against OWASP core rule sets — the `' OR '1'='1'` pattern triggers a SQLi rule.
04 Action the WAF blocks the request with `403 Forbidden` and logs the event. The attacker never touches your server.
POKE IT YOURSELF
aws wafv2 list-web-acls --scope REGIONAL — list WAF web ACLs
aws wafv2 get-web-acl --name my-acl --scope REGIONAL --id ACL_ID — inspect WAF rules and conditions
Drill this topic →
~75 sec read