Web Application Firewall (WAF) is a security solution that filters out malicious traffic from reaching a web application or API by examining HTTP/HTTPS requests. It primarily operates at the OSI Layer 7 level and can detect application-level attacks like SQL injection and cross-site scripting. A WAF is an additional layer of security and operates in conjunction with a network firewall, not in place of it.
Introduction
A web request can be a normal request and still contain something that an application should never have. An attack can be a backdoor through a login attempt, a form submission, or even a simple page visit.
This is where a Web Application Firewall (WAF) comes in. It is placed between the user and the application, and it looks at the traffic on the web and determines what should be allowed and what should be blocked.
So what is a WAF looking for and how does it make that decision? This guide explains what a WAF is, how it functions, what types of attacks it can defend against, and the difference between a WAF and a traditional firewall.
What is a WAF in Networking?
A WAF (Web Application Firewall) defends against web attacks by examining web traffic before it reaches the application. It analyzes incoming HTTP/HTTPS requests and applies security rules to determine whether to allow, block, or challenge a request.
A WAF primarily works at OSI Layer 7, the application layer, to examine the application-layer details of the Web, including the URL, headers, query strings and request data. It is often used as a reverse proxy between Internet users and the application.
The main difference is the protection each security tool offers. A network firewall manages network access based on IP addresses, ports and protocols, whereas a WAF manages the content and behavior of web requests. Both work together to offer wider protection, not in place of each other.
For a deeper understanding of WAFs, read our detailed guide on What is a Web Application Firewall and how it works.
What is the Purpose of a WAF in Networking?
The main purpose of a WAF in networking is to protect websites, web applications, and APIs from malicious HTTP/HTTPS requests. It is placed between the users and the application and monitors the web traffic prior to its arrival at the server.
1. Filter Malicious Traffic
A WAF checks incoming requests against security rules and can block requests that match malicious patterns.
2. Protect Against Application Attacks
A WAF is unlike a traditional firewall, which primarily regulates network access, it actually analyzes web requests. This can be useful in identifying attacks like SQL injection and cross-site scripting (XSS).
3. Add an Extra Security Layer
A WAF acts as a firewall between the public Internet and the application, minimizing direct exposure to potentially harmful web traffic.
4. Control Suspicious Requests
A WAF can either allow, block, monitor or challenge requests based on security rules it has been configured with.
A network firewall is used to manage access to a resource, and a WAF is used to review what a web request is attempting to do.
How Does a WAF Work?
A WAF is a security barrier between users and a web application. It evaluates incoming HTTP/HTTPS requests and determines if they should be passed to the application according to the security rules that are configured.
1. A User Sends a Request
A visitor can visit a page, fill out a form, log in, or call an API. The WAF is the first to check the request.
2. The WAF Inspects the Request
The WAF analyzes information like IP address, URL, HTTP method, headers, query strings, request body, and request rates for suspicious patterns.
3. Security Rules Take Action
The request is compared to the rules in the WAF. The WAF can permit, deny, observe, or question the request based on the outcome.
4. The Application Processes Safe Requests
If the request passes the security checks, it is passed on to the web server or application. Unwanted or malicious requests can be blocked before they arrive at the application.
To sum up, a WAF monitors web requests, matches them to security rules, and blocks or allows them based on the rules.
What Attacks Does a WAF Protect Against?
A WAF can be used to detect and block malicious HTTP/HTTPS requests to protect web applications. It can identify some common application-layer threats, but its effectiveness will vary based on the rules, configuration, and type of WAF.
| Attack | What the WAF helps detect |
| SQL Injection | Malicious database queries hidden in web requests |
| Cross-Site Scripting (XSS) | Malicious scripts inserted into web input |
| File Inclusion | Attempts to load unauthorized files |
| Path Traversal | Attempts to access restricted files or directories |
| HTTP-based attacks | Malformed or suspicious web requests |
| Bot & automated abuse | Unwanted automated traffic, depending on WAF capabilities |
| Application-layer DoS | Excessive or abusive HTTP request patterns |
The most common threats that are mitigated by WAFs include SQL injection, XSS, and file inclusion.
But, a WAF is not a substitute for secure coding or application security testing. It offers an extra level of security and can lessen the effect of attacks, but weaknesses should be addressed at the application level.
WAF vs Firewall: What is the Difference?
Both a WAF and traditional network firewall enhance security, but they do so for different portions of the infrastructure. A network firewall regulates network traffic, and a WAF regulates web application traffic, and can inspect HTTP/HTTPS requests at Layer 7.
| WAF | Network Firewall |
| Protects web applications and APIs | Protects networks and resources |
| Works mainly at Layer 7 | Primarily works at lower network layers |
| Inspects HTTP/HTTPS requests | Filters network traffic |
| Examines application-level details | Evaluates factors such as IPs, ports, and protocols |
| Helps mitigate attacks such as SQL injection and XSS | Controls network access |
Does a WAF take the place of a firewall? No. The two should be considered complementary security layers. A firewall is used to regulate access to the network, and a WAF is used to inspect the actions of web traffic.
Does a WAF Protect Against DDoS Attacks?
A WAF can be used to help defend against application-layer DDoS attacks, such as by filtering out suspicious HTTP/HTTPS requests and by implementing rate-limiting or challenge rules.
But a WAF is not a panacea for all DDoS attacks. Dedicated DDoS protection may be required as part of a larger security solution to counter large volumetric attacks before application-level filtering can be of any benefit.
The bottom line is that a WAF can be used to protect the application layer, but it’s not a full DDoS solution.
When Does a Website Need a WAF?
A WAF can be especially useful when a site or application is accessible to the public and can be used for malicious purposes. It may be a good complement for:
- Websites that have login or customer accounts
- This is the address for the online stores and payment pages.
- Public APIs
- High-traffic websites
- WordPress and other CMS based sites.
- Applications that deal with sensitive data
It’s also useful when teams need to respond quickly to new threats on the web without changing the application.
A WAF should be used in addition to secure coding, software updates, access controls, backups, malware protection and network security. It’s an additional layer of protection, not a patch for the vulnerabilities within the application.
How is a WAF Deployed?
WAFs are commonly deployed in three ways:
Cloud-Based WAF
The WAF runs as a managed service and filters traffic before it reaches the application. This is often the simplest option to scale and maintain.
Network-Based WAF
Usually deployed as a dedicated appliance within an organization’s infrastructure. It provides greater control but requires more management.
Host-Based WAF
Runs closer to the application, giving teams more control over application-specific protection while using some server resources.
Cloudflare identifies these three deployment models and notes that cloud-based WAFs can simplify deployment and ongoing updates.
Final Takeaway
A WAF provides a security gate between the public Internet and the application. It analyzes the HTTP/HTTPS traffic, detects suspicious requests, and aids in blocking application-layer attacks before they reach the server. It is not a network firewall or secure development practices. Rather, it functions in tandem with them to provide a more comprehensive and multi-layered security system.
For businesses with websites and applications, the security of the server infrastructure, firewall protection, monitoring, backups and regular security maintenance are all important in keeping that application secure.
FAQs
What is the main purpose of a WAF?
A WAF is a security solution that monitors web traffic and filters out malicious requests to safeguard websites, web applications, and APIs. It can help prevent threats like SQL injection and cross-site scripting before they get to the application.
How does a WAF work?
A WAF checks incoming HTTP/HTTPS requests against security rules. It can then permit legitimate traffic or block, monitor or challenge requests that seem suspicious.
Is a WAF a Layer 7 firewall?
Yes. A WAF is mainly used at the application layer (OSI Layer 7). This allows it to examine web-specific data like query strings, request data, headers, and URLs.
Does a WAF replace a traditional firewall?
No. A network firewall is used to regulate access to network resources, and a WAF is used to regulate web application traffic. Both offer multiple layers of protection.
Can a WAF prevent SQL injection and XSS?
Many SQL injection and XSS attacks can be identified and prevented by a well-configured WAF. It should not be used as a substitute for secure coding, frequent updates, vulnerability testing or other application security practices, however.
