How WAF works
A WAF sits in front of a web application, typically as a reverse proxy, and examines each request and response. It compares them with rules and behavior models to identify attacks such as injection attempts or malformed input.
Matching requests can be blocked, challenged or logged. Rules may follow a negative model that blocks known bad patterns, or a positive model that only allows known good traffic. Many WAFs also offer rate limiting and bot management. Deployment options include cloud-based services that change DNS to route traffic, appliances placed in the data center, and agents or modules running alongside the application on the web server.
Why it matters for Canadian organizations
Public web applications face constant automated probing. A WAF can provide quick protection while developers fix code, a technique known as virtual patching, and gives visibility into attack attempts.
PCI DSS expects public-facing web applications to be protected by a WAF or equivalent review. For organizations holding personal information, it also supports the safeguards expected under PIPEDA and Law 25. Without tuning, a WAF can either block legitimate users or miss attacks, so ongoing rule review and testing with real application workflows are essential after each major release.
How to implement it
Deploy in monitoring mode first to learn normal traffic and tune out false positives, then move to blocking. Keep rule sets updated and protect all internet-facing applications and APIs.
A WAF is not a substitute for secure coding. Combine it with code review, testing, patching and logging, and send WAF alerts to your SOC so blocked attacks are reviewed rather than ignored. Make sure TLS traffic is decrypted at the WAF so it can inspect requests, and protect APIs as well as web pages, since APIs are increasingly attacked directly.
Frequently asked questions
What is the difference between a WAF and a firewall?
A network firewall filters traffic by address, port and protocol. A WAF understands web traffic and inspects HTTP requests and responses for application attacks such as SQL injection and cross-site scripting that a network firewall cannot recognize. They protect different layers of the stack.
Does a WAF stop DDoS attacks?
Many cloud WAFs include protection against application-layer DDoS through rate limiting and bot detection. Large volumetric attacks usually need separate network-level DDoS mitigation, often provided by the same cloud vendor. Bot management and rate limiting are often included features too.
Can a WAF replace secure coding?
No. A WAF reduces risk but can be bypassed and does not fix the underlying flaw. Secure development, testing and patching remain essential, with the WAF acting as an additional protective layer. Defense in depth remains the right goal.
Related service: Application security