Application firewall (WAF)

from the WAF's IP ranges or via a shared secret header, preventing attackers from bypassing the WAF by targeting the origin directly. 4. Schema Validation: WAF rules should enforce strict JSON schema validation for API endpoints. This blocks structural attacks that signature rules might miss.

Step-by-Step Implementation

1. WAF Configuration Strategy

Configure the WAF to use the OWASP Core Rule Set (CRS) as a baseline, then overlay custom rules for API schema validation. Enable Detection Mode initially to analyze traffic without blocking, then transition to Enforcement Mode after tuning.

2. TypeScript Integration: WAF Context Handler

The application must trust and utilize WAF-provided headers for rate limiting and identity resolution. The following TypeScript middleware extracts WAF context and implements a fallback security layer.

import { Request, Response, NextFunction } from 'express';

// Interface defining the security context injected by the WAF
interface WafSecurityContext {
  clientIp: string;
  isBlocked: boolean;
  ruleId?: string;
  botScore?: number;
  rateLimitRemaining?: number;
}

// Middleware to parse WAF headers and enforce origin trust
export const wafContextMiddleware = (
  wafSecretHeader: string,
  trustedWafIpRanges: string[]
) => {
  return (req: Request, res: Response, next: NextFunction) => {
    // 1. Verify Origin Trust
    const sourceIp = req.socket.remoteAddress;
    if (!sourceIp || !isTrustedIp(sourceIp, trustedWafIpRanges)) {
      // Direct origin access detected; block request
      res.status(403).json({ error: 'Forbidden: Direct origin access blocked' });
      return;
    }

    // 2. Validate WAF Secret
    const wafSecret = req.headers[wafSecretHeader];
    if (!wafSecret || wafSecret !== process.env.WAF_SHARED_SECRET) {
      res.status(403).json({ error: 'Forbidden: Invalid WAF signature' });
      return;
    }

    // 3. Extract Security Context
    const securityContext: WafSecurityContext = {
      clientIp: req.headers['x-forwarded-for']?.toString().split(',')[0].trim() || sourceIp,
      isBlocked: req.headers['x-waf-blocked'] === 'true',
      ruleId: req.headers['x-waf-rule-id']?.toString(),
      botScore: req.headers['x-waf-bot-score'] 
        ? parseInt(req.headers['x-waf-bot-score'].toString(), 10) 
        : undefined,
      rateLimitRemaining: req.headers['x-ratelimit-remaining'] 
        ? parseInt(req.headers['x-ratelimit-remaining'].toString(), 10) 
        : undefined,
    };

    // 4. Enforce WAF Decisions
    if (securityContext.isBlocked) {
      res.status(403).json({ 
        error: 'Blocked by WAF', 
        ruleId: securityContext.ruleId 
      });
      return;
    }

    // 5. Attach context for downstream logic
    req.wafContext = securityContext;
    next();
  };
};

// Helper for IP range checking
function isTrustedIp(ip: string, ranges: string[]): boolean {
  // Implementation using ip-cidr library for efficient range matching
  // ...
  return true; // Placeholder
}

// Usage in Express App
const app = express();
app.use(wafContextMiddleware('x-waf-secret', ['192.0.2.0/24']));

app.post('/api/v1/transactions', (req: Request, res: Response) => {
  // Access WAF context for rate limiting or bot detection logic
  const ctx = req.wafContext as WafSecurityContext;
  
  if (ctx.botScore && ctx.botScore < 30) {
    // WAF identified high probability bot; enforce CAPTCHA or challenge
    return res.status(429).json({ error: 'Bot behavior detected' });
  }

  // Proceed with business logic
  res.json({ status: 'processed' });
});

3. API Schema Enforcement

Integrate WAF rules that validate request bodies against OpenAPI/Swagger schemas. This prevents type confusion attacks and ensures data integrity before it reaches the application logic.

4. Logging and Telemetry

Configure the WAF to stream logs to a centralized SIEM. Implement anomaly detection on blocked request patterns to identify new attack vectors. Use the telemetry to refine rules dynamically.

Pitfall Guide

1. Relying Solely on WAF for Input Validation

Mistake: Treating the WAF as a replacement for application-level input sanitization. Explanation: WAFs can be bypassed via encoding variations, fragmentation, or logic flaws. Attackers who bypass the WAF gain direct access to vulnerable code. Best Practice: Always validate and sanitize inputs within the application code. The WAF is a supplementary control, not the primary defense.

2. Ignoring API Schema Validation

Mistake: Using generic regex rules for API endpoints without enforcing strict JSON schemas. Explanation: APIs often accept complex nested objects. Regex rules may miss structural anomalies or type mismatches that lead to injection or deserialization attacks. Best Practice: Configure WAF rules to validate payloads against the OpenAPI specification. Reject requests that deviate from the expected schema structure.

3. Host Header Manipulation Bypass

Mistake: Failing to validate the Host header, allowing attackers to send requests with a spoofed host that matches a different virtual host configuration. Explanation: Attackers can manipulate the Host header to route traffic to unintended backend services or bypass WAF rules associated with a specific domain. Best Practice: Enforce strict Host header validation in both the WAF and the application. Ensure the WAF only processes traffic for authorized domains.

4. High False Positives from Overly Broad Regex

Mistake: Using aggressive regular expressions that match legitimate user input. Explanation: Overly broad rules (e.g., blocking any request containing SELECT) can block legitimate search queries or data submissions, causing user frustration and operational noise. Best Practice: Tune rules based on actual traffic analysis. Use allow-listing for known safe patterns and restrict regex scope to specific contexts (e.g., SQL injection only in parameters expected to contain IDs).

5. TLS Termination Misconfiguration

Mistake: Allowing TLS termination at the origin server while the WAF is deployed in transparent mode. Explanation: If the WAF cannot decrypt traffic, it cannot inspect the body for malicious payloads. The WAF only sees encrypted blobs, rendering it ineffective. Best Practice: Ensure the WAF performs TLS termination. If end-to-end encryption is required, use mutual TLS (mTLS) with the WAF, or deploy the WAF as a sidecar proxy that terminates and re-encrypts traffic.

6. Static Rule Sets vs. Dynamic Threats

Mistake: Deploying WAF rules and never updating them. Explanation: Attack techniques evolve rapidly. Static rule sets become obsolete, leaving the application vulnerable to new exploits. Best Practice: Automate rule updates using managed rule sets (e.g., AWS WAF Managed Rules, Cloudflare Rules). Schedule regular reviews of custom rules and leverage behavioral analysis to detect anomalies without rule updates.

7. Performance Degradation Due to Unoptimized Rules

Mistake: Adding complex, nested regex rules or excessive custom logic without performance testing. Explanation: WAF processing adds latency. Unoptimized rules can cause CPU spikes on the WAF nodes, increasing response times and potentially causing timeouts. Best Practice: Profile rule performance. Prefer exact match and prefix matching over complex regex. Monitor WAF latency metrics and tune rules that contribute disproportionately to processing time.

Production Bundle

Action Checklist

• Audit Attack Surface: Map all public-facing endpoints, including APIs, GraphQL, and WebSocket connections, to ensure WAF coverage.
• Enable Managed Rule Sets: Activate OWASP CRS and vendor-managed rule sets for baseline protection against known vulnerabilities.
• Configure API Schema Validation: Define strict JSON schema validation rules for all API endpoints based on OpenAPI specs.
• Set Up Origin Trust: Configure the origin to accept traffic only from WAF IP ranges or via shared secret headers to prevent bypass.
• Implement Detection Mode: Deploy WAF in detection mode first; analyze logs for false positives and legitimate traffic patterns before enforcement.
• Enable Rate Limiting: Configure rate-based rules to mitigate credential stuffing, DDoS, and scraping attacks.
• Integrate Logging: Stream WAF logs to a SIEM for real-time alerting and historical analysis.
• Test for Bypasses: Conduct regular penetration testing to verify WAF effectiveness and identify bypass vectors.

Decision Matrix

Scenario	Recommended Approach	Why	Cost Impact
Startup / MVP	Cloud WAF SaaS (e.g., Cloudflare, AWS WAF)	Rapid deployment, managed rules, low operational overhead.	Low setup, pay-as-you-go.
Enterprise API Platform	Context-Aware WAF + API Gateway	Deep API schema validation, bot management, high throughput.	Medium cost, high ROI via risk reduction.
Legacy Monolith	Open Source WAF (ModSecurity/Coraza) as Sidecar	Granular control, integration with existing infra, no vendor lock-in.	High engineering effort, low licensing cost.
High-Volume E-commerce	Managed WAF with Bot Management	Protection against scalping, inventory hoarding, and fraud.	Premium cost, essential for revenue protection.

Configuration Template

Terraform Template: AWS WAF with CRS and Rate Limiting

resource "aws_wafv2_web_acl" "app_waf" {
  name        = "app-waf-${var.environment}"
  description = "WAF for production application"
  scope       = "REGIONAL" # Use CLOUDFRONT for global distribution

  default_action {
    allow {}
  }

  rule {
    name     = "AWSManagedRulesCommonRuleSet"
    priority = 1

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "AWSManagedRulesCommonRuleSet"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "RateLimitRule"
    priority = 2

    action {
      block {}
    }

    statement {
      rate_based_statement {
        limit              = 2000
        aggregate_key_type = "IP"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "RateLimitRule"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "app-waf-metrics"
    sampled_requests_enabled   = true
  }

  tags = {
    Environment = var.environment
  }
}

Quick Start Guide

1. Select WAF Provider: Choose a cloud-native WAF (AWS WAF, Azure WAF, GCP Cloud Armor) or a SaaS provider based on your infrastructure.
2. Attach to Resource: Associate the WAF with your load balancer, API Gateway, or CDN distribution. Ensure it is positioned at the edge of your network.
3. Enable Detection Mode: Activate the WAF in detection mode only. Do not enable blocking immediately. This allows you to observe traffic and identify potential false positives without impacting users.
4. Analyze Logs: Review WAF logs for blocked requests and false positives. Tune rules to whitelist legitimate traffic patterns and adjust thresholds.
5. Switch to Enforcement: Once logs indicate stable operation with minimal false positives, switch the WAF to enforcement mode. Monitor metrics continuously and adjust rules as needed.