DataTerminology.comNEW
Also known as: WAF
A security control that filters and monitors HTTP(S) traffic to protect web applications from attacks.
DESCRIPTION
A web application firewall (WAF) inspects HTTP(S) traffic at layer 7, enforcing rules that block attacks like SQL injection, cross-site scripting, and request smuggling. WAFs can be network-based, host-based, or cloud-managed and often integrate with CDNs and API gateways. Tuned rulesets, positive security models, and virtual patching help mitigate zero-days. Modern WAFs incorporate bot management, rate limiting, and API schema validation. Key challenges include false positives, evasion techniques, and maintaining rule hygiene as applications evolve.
ALTERNATIVE DEFINITIONS
OWASP
A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation.
Highlights rule-based protection specific to HTTP applications.
Cloudflare
A web application firewall (WAF) helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet.
Emphasizes placement between app and Internet for traffic filtering.
RELATED TERMS
Reverse Proxy Content Delivery Network DDoS Protection OWASP Top Ten API Gateway Bot Management Rate Limiting SQL Injection
COMPETING TERMS
Intrusion Prevention System Runtime Application Self-Protection
KNOWLEDGE AREAS
Data Security Infrastructure Cloud
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Chief Information Security Officer DevOps Engineer Cloud Architect Application Administrator
EXTERNAL SOURCES
- Wikipedia - Web application firewall
- OWASP - Community overview and guidance on WAFs
- AWS - AWS WAF service documentation overview
- Microsoft - Azure WAF overview and concepts
- Cloudflare - Cloud-managed WAF product documentation
TOP QUESTIONS
What is a Web Application Firewall and why is it used?
A WAF inspects HTTP(S) traffic to block web attacks like SQL injection and XSS. It protects applications without code changes, acting as a shield at layer 7.
Category: Basics
How does a Web Application Firewall differ from a network firewall?
A WAF understands HTTP semantics and application logic, while network firewalls filter based on IPs, ports, and protocols. WAFs mitigate application-layer threats.
Category: Comparison
What are common mistakes when configuring a Web Application Firewall?
Deploying with default rules, ignoring tuning, and not excluding false positives are common. Skipping continuous updates leaves apps exposed to new attack vectors.
Category: Mistakes
How does a Web Application Firewall help with OWASP Top Ten risks?
WAFs provide signatures and positive validation to detect injection, XSS, and deserialization. They complement secure coding and scanning but don’t replace them.
Category: Application
What is virtual patching in the context of a Web Application Firewall?
Virtual patching uses WAF rules to block known exploits before code fixes are deployed. It reduces exposure window for vulnerable endpoints.
Category: Concept
Is a Web Application Firewall sufficient for API security?
A WAF helps with traffic filtering and rate limiting, but API security also needs schema validation, authentication, and authorization controls. Use multiple layers.
Category: Scope
What are the trade-offs of self-managed versus cloud WAF?
Self-managed offers control but requires expertise and scaling. Cloud WAFs provide managed rules and global reach, with potential vendor lock-in considerations.
Category: Decision
How do Web Application Firewalls handle bot traffic?
Modern WAFs use behavioral analysis, device fingerprinting, and challenge-response to detect and mitigate malicious bots while allowing good bots.
Category: Technique
When should you bypass or exclude traffic from the Web Application Firewall?
Exclude trusted health checks, specific admin paths, or known safe partners when necessary. Always document exceptions and monitor for abuse.
Category: Operations