We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningIntermediate · Security Architecture
Web Application Firewall: filters and monitors HTTP traffic between a web application and the internet. Blocks SQL injection, XSS, and other OWASP top-10 attacks.
In short
A Web Application Firewall (WAF) is a security filter that sits in front of a web application and inspects every incoming HTTP and HTTPS request, blocking malicious traffic like SQL injection, cross-site scripting (XSS), and other application-layer attacks before it reaches your servers. Unlike a network firewall that works on IP addresses and ports, a WAF understands HTTP and makes decisions based on the actual content of requests.
In short
A Web Application Firewall (WAF) is a security filter that sits in front of a web application and inspects every incoming HTTP and HTTPS request, blocking malicious traffic like SQL injection, cross-site scripting (XSS), and other application-layer attacks before it reaches your servers. Unlike a network firewall that works on IP addresses and ports, a WAF understands HTTP and makes decisions based on the actual content of requests.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers WAF across a run of lessons, not one page. These 4 alone are about 70 minutes of step-by-step reading, every one with a quiz.
Filtering malicious HTTP traffic before it reaches your application, blocking SQL injection, XSS, and other web attacks at the edge.
Intrusion Prevention Systems, actively blocking detected attacks in real-time.
The oldest and most devastating web attack, injecting malicious SQL through unsanitized user input.
Cross-Site Scripting, injecting malicious scripts into web pages viewed by other users.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with Web Application Firewall (WAF)pay once,
yours for life
A WAF is a reverse proxy that every request to your application passes through. It reads the full HTTP request (URL, headers, cookies, query string, and body) and decides whether to allow it, block it, or flag it before the request ever touches your application code.
The key difference from a normal network firewall is the layer it works at. A network firewall operates at layers 3 and 4, so it only sees IP addresses, ports, and protocols. A WAF operates at layer 7, the application layer, so it can read that a form field contains the string ' OR 1=1-- and recognize it as a SQL injection attempt.
WAFs are most often described in terms of the OWASP Top 10, the industry list of the most common web vulnerabilities. A good WAF ships with rules that cover injection, broken access patterns, XSS, and similar categories out of the box, then lets you add your own rules on top.
A WAF inspects requests using two broad strategies. A negative security model (a blocklist) looks for known-bad patterns: signatures and regular expressions that match attack payloads. The widely used OWASP Core Rule Set is a negative model with hundreds of these rules. A positive security model (an allowlist) does the opposite and only permits requests that match a known-good schema, rejecting everything else.
Each rule typically carries a score rather than an instant block. The OWASP Core Rule Set, for example, adds points for each suspicious signal a request triggers, and only blocks once the total crosses a threshold (commonly 5). This anomaly scoring reduces false positives, since one weak signal alone will not get a legitimate user blocked.
Modern WAFs add layers beyond signatures: rate limiting to stop brute force and scraping, bot detection, geo and IP reputation lists, and managed rule sets that the vendor updates as new attacks appear. Many run in two modes, detection (log only, no blocking) so you can tune rules safely, and prevention (actively block), which is what you switch to once tuned.
Use a WAF when you have a public web application or API that accepts user input, especially if you handle logins, payments, or personal data. It is also a fast way to satisfy compliance requirements: PCI DSS, the payment card standard, effectively requires either a WAF or regular code review for public-facing apps.
A WAF is not a replacement for secure code. It is a layer of defense in depth. Attackers find encodings and edge cases that slip past signatures, so a WAF that catches 95 percent of attacks still lets the other 5 percent through if your code itself is vulnerable. Treat it as a safety net, not the whole net.
The main costs are latency and false positives. Every request now passes through an extra hop and inspection step, usually adding single-digit milliseconds with a cloud WAF but more if self-hosted poorly. False positives are the bigger operational pain: an over-aggressive rule can block real customers, so teams almost always run in detection mode first and tune for days before turning on blocking.
Say your app has a search box that builds a SQL query. An attacker submits the search term ' UNION SELECT password FROM users--. Without a WAF, that string reaches your code, and if the query is not parameterized, the attacker dumps your password table.
With a WAF in front, the request is inspected first. The OWASP rule for SQL injection matches the UNION SELECT pattern and the comment sequence --, the anomaly score crosses the threshold, and the WAF returns a 403 Forbidden. Your application never sees the request, and the event is logged so your security team can see the source IP and block it.
In practice you would deploy this by pointing your DNS at the WAF (as with Cloudflare or AWS) or running it as a module in front of your servers (as with ModSecurity on Nginx), then watching the logs in detection mode before flipping to active blocking.
Cloudflare
Runs one of the largest cloud WAFs; you point your domain's DNS at Cloudflare and all traffic is filtered at their edge before reaching your origin.
AWS WAF
Attaches to CloudFront, Application Load Balancer, or API Gateway, with managed rule groups for the OWASP Top 10 and bot control billed per rule and per million requests.
ModSecurity
The open-source WAF engine that pioneered the OWASP Core Rule Set, run as a module in front of Nginx or Apache.
Imperva
Enterprise WAF used by banks and large retailers, offered both as an on-prem appliance and a cloud service with DDoS protection bundled in.
A regular network firewall works at layers 3 and 4, filtering on IP addresses, ports, and protocols. A WAF works at layer 7, the application layer, so it reads the actual HTTP request content and can block attacks like SQL injection and XSS that a network firewall cannot see. You typically run both, since they protect different layers.
No. A WAF is a defense-in-depth layer, not a substitute for fixing vulnerabilities in your code. Attackers use encodings and edge cases that slip past signatures, so a WAF buys you time and blocks the common attacks, but you still need parameterized queries, input validation, and proper access control in the application itself.
A false positive is when the WAF blocks a legitimate request because it looks like an attack. For example, a user writing about SQL in a forum post might trigger an injection rule. This is why teams run a WAF in detection mode first, watch the logs, and tune rules before switching to active blocking.
It is a free, open-source set of WAF rules maintained by the OWASP project that covers the most common web attacks. It uses anomaly scoring, adding points for each suspicious signal and blocking only when the total crosses a threshold, which keeps false positives lower than a strict block-on-first-match approach. ModSecurity, Cloudflare, and AWS all build on or offer it.
Yes, but usually a small amount. Every request passes through an extra inspection step. A cloud WAF at the edge typically adds single-digit milliseconds and can even speed things up through caching, while a poorly configured self-hosted WAF can add more. The protection almost always outweighs the cost for public-facing apps.
SQL Injection
An attack where malicious SQL is inserted into a query through user input. Prevented by parameterized queries and prepared statements. Never concatenate user input into SQL.
XSS
Cross-Site Scripting: an attack where malicious scripts are injected into trusted websites. Prevented by sanitizing user input and setting Content-Security-Policy headers.
Reverse Proxy
A server in front of your web servers that receives every request first, passes it to one of them and returns the answer. It handles TLS, load balancing, caching and routing, and hides the servers behind it.
Throttling
Slowing down the rate of processing requests instead of rejecting them outright. The gentler cousin of rate limiting.
OAuth
An authorization framework that lets users grant third-party apps limited access to their accounts without sharing passwords. Powers 'Sign in with Google.'
JWT
JSON Web Token: a compact, self-contained token for transmitting claims between parties. The server can verify it without a database lookup.
This page explains the idea. The "Web Application Firewall (WAF)" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the Web Application Firewall (WAF) lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about WAF in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
