A web application firewall (WAF) is an application-level firewall that usually runs as a reverse proxy in front of APIs. It inspects HTTP requests and blocks or cleans content that appears malicious, adding a security layer between clients and the application. section 2.3.4 section 9.4
WAFs are especially useful against recognized web threats such as SQL injection, cross-site scripting (XSS), SSRF, suspicious requests, and bots. Modern products may also support API-specific validation, zero-day protection, and attacks across lower networking layers. section 2.3.4 section 9.5
Blocking a malicious payments query
Consider GET /payments?filter=' or 1=1--. If the endpoint inserts filter into a database query, the payload can disable the user_id constraint and expose records belonging to other users. A WAF can recognize the injection and block the request or remove the malicious content. Cleaning is not automatically safe: an obfuscated request such as GET /payments?filter='+o//r+1=1-- can bypass some implementations and become executable after sanitization. section 9.4
Use a WAF as one part of a broader API security design:
- Place it in front of APIs, commonly alongside an API gateway, to inspect incoming traffic and apply an additional protection layer. section 2.3.4 section 9.4
- Feed modern WAFs an API specification when supported so their protections can match the API’s particular needs. section 2.3.4
- Prefer carefully evaluated detection rules or probabilistic methods, recognizing that overly permissive rules miss attacks and overly strict rules can cause problems. section 9.4
- Do not treat the WAF as a substitute for secure authorization: it does not prevent every API weakness, including BOLA, where users access data belonging to others. section 2.3.4
Figure 9.13 The OSI model breaks the elements required to enable communication between systems into seven layers. Layer 1 describes the physical medium, such as switches and cables, and layer 7 describes the application layer, such as APIs. Many API attacks target layers 3–6 and demand special security measures.
Use the OSI-layer figure to place WAF protection in the application layer while distinguishing it from defenses for lower-layer attacks. section 9.3
