Web application firewall (WAF)

A WAF terminates or inspects HTTP(S) traffic at layer 7, which means it must see decrypted traffic: it either terminates TLS itself as a reverse proxy, runs as a module inside the web server or ingress controller, or is delivered as a cloud or CDN edge service. Deployment modes include inline blocking, transparent bridging and out-of-band monitoring from a traffic copy, which can detect but not block. It parses the request into components such as method, URI, query arguments, headers, cookies and a body decoded as form data, JSON, XML or multipart, normalises encodings, and evaluates rules against each part.

The dominant open rule set is the OWASP ModSecurity Core Rule Set (CRS), which runs on the ModSecurity engine, now an OWASP project, and on Coraza. CRS uses anomaly scoring by default: each matching rule adds points, typically 5 for a critical match, and the request is blocked only when the total exceeds a threshold, default 5 for inbound traffic. Paranoia levels 1 to 4 trade coverage against false positives, and production tuning consists largely of writing rule exclusions for specific parameters that legitimately contain SQL-like or HTML-like content. Commercial WAFs add bot detection, rate limiting, IP reputation, API schema enforcement and machine-learning classifiers on top of signatures.

Two security models are used. A negative model blocks known-bad patterns and is easy to deploy but can be bypassed; a positive model allows only what the application is known to accept, such as defined paths, methods, parameter types and lengths, often derived from an OpenAPI description, which is stronger but costly to maintain as the application changes. Known bypass classes include alternative encodings, case and comment tricks in SQL, HTTP parameter pollution, request smuggling where the WAF and back end disagree on message boundaries, payloads in content types the WAF does not parse, and oversized bodies beyond the inspection limit. In 2022 Claroty showed that several major WAFs could be bypassed with JSON-based SQL syntax because their parsers did not understand it.

The main legitimate use is virtual patching: blocking exploitation of a known vulnerability, such as Log4Shell in December 2021, while the fix is developed and deployed. PCI DSS v4.0 requirement 6.4.2, mandatory since 31 March 2025, requires an automated technical solution that continually detects and prevents web-based attacks in front of public-facing web applications, and a WAF is the usual way to meet it. A WAF cannot see business-logic flaws, broken object-level authorization, or stored payloads already inside the application, so it complements rather than replaces secure code.