OWASP Web Application Firewall
A web application firewall, or WAF, sits in front of a web application and inspects every request. It blocks traffic that matches known attack patterns and lets normal visitors pass. A WAF adds a protective layer without changing the application code.
The Security Guard Comparison
A guard at a building entrance checks bags for forbidden items. The guard does not repair broken doors inside the building, yet the checks stop many problems at the entrance. A WAF plays that role for a website.
Where the WAF Sits
Visitors
|
↓
+----------------+
| WAF | inspects requests and responses
+----------------+
| allowed requests only
↓
+----------------+
| Web server / |
| application |
+----------------+
|
↓
Database
How a WAF Decides
Rule Matching
Rules describe suspicious patterns in URLs, headers, and request bodies. A request that matches a rule receives a score or a direct block.
Anomaly Scoring
Many WAFs add points for each suspicious sign. The request passes while the total stays below a threshold and blocks when the total rises above it. Scoring reduces false alarms compared with one-rule decisions.
Behavior Checks
Modern WAFs also watch request rates, known bad sources, and bot behavior.
The OWASP Core Rule Set
OWASP maintains the Core Rule Set, often shortened to CRS. The free rule collection works with engines such as ModSecurity and Coraza. CRS covers common categories: SQL injection patterns, cross-site scripting, local file inclusion, protocol violations, and scanner detection. Many commercial and cloud WAFs build on the same ideas.
Deployment Types
| Type | Description | Typical Choice For |
|---|---|---|
| Cloud service | Traffic passes through a provider's network | Fast setup and public websites |
| Reverse proxy appliance | A dedicated server sits before the application | Data centers with strict control |
| Host module | A module runs inside the web server | Small projects and testing |
Detection Mode and Blocking Mode
New WAFs start in detection mode. The WAF logs matches without blocking anything. Teams review the log, find legitimate requests that look suspicious, and write exceptions. After tuning, the team switches to blocking mode. Skipping this step breaks real features and frustrates users.
What a WAF Can Do
- Block many automated attacks and scanning tools.
- Provide virtual patching: a quick rule that shields a known flaw while developers prepare the real fix.
- Limit abusive traffic and bots.
- Record attack attempts for investigation.
What a WAF Cannot Do
- Fix insecure code. Attackers adapt payloads to slip past rules.
- Understand business logic, so abuse of valid features passes through.
- Replace authentication and authorization checks inside the application.
Treat the WAF as a safety net under a secure application, never as the only protection.
Operating Tips
- Start in detection mode and review logs for at least a week of normal traffic.
- Tune rules per application instead of disabling whole categories.
- Send WAF logs to a central monitoring system.
- Update rule sets regularly.
- Test the WAF after each application release.
Key Takeaways
- A WAF filters web traffic before it reaches the application.
- The OWASP Core Rule Set offers a free, widely used rule collection.
- Tuning in detection mode prevents false blocks.
- Secure code remains the primary defense.