Application firewall (WAF)

ndefined, rateLimitRemaining: req.headers['x-ratelimit-remaining'] ? parseInt(req.headers['x-ratelimit-remaining'].toString(), 10) : undefined, };

// 4. Enforce WAF Decisions
if (securityContext.isBlocked) {
  res.status(403).json({ 
    error: 'Blocked by WAF', 
    ruleId: securityContext.ruleId 
  });
  return;
}

// 5. Attach context for downstream logic
req.wafContext = securityContext;
next();

}; };

// Helper for IP range checking function isTrustedIp(ip: string, ranges: string[]): boolean { // Implementation using ip-cidr library for efficient range matching // ... return true; // Placeholder }

// Usage in Express App const app = express(); app.use(wafContextMiddleware('x-waf-secret', ['192.0.2.0/24']));

app.post('/api/v1/transactions', (req: Request, res: Response) => { // Access WAF context for rate limiting or bot detection logic const ctx = req.wafContext as WafSecurityContext;

if (ctx.botScore && ctx.botScore < 30) { // WAF identified high probability bot; enforce CAPTCHA or challenge return res.status(429).json({ error: 'Bot behavior detected' }); }

// Proceed with business logic res.json({ status: 'processed' }); });

#### 3. API Schema Enforcement
Integrate WAF rules that validate request bodies against OpenAPI/Swagger schemas. This prevents type confusion attacks and ensures data integrity before it reaches the application logic.

#### 4. Logging and Telemetry
Configure the WAF to stream logs to a centralized SIEM. Implement anomaly detection on blocked request patterns to identify new attack vectors. Use the telemetry to refine rules dynamically.

## Pitfall Guide

### 1. Relying Solely on WAF for Input Validation
**Mistake:** Treating the WAF as a replacement for application-level input sanitization.
**Explanation:** WAFs can be bypassed via encoding variations, fragmentation, or logic flaws. Attackers who bypass the WAF gain direct access to vulnerable code.
**Best Practice:** Always validate and sanitize inputs within the application code. The WAF is a supplementary control, not the primary defense.

### 2. Ignoring API Schema Validation
**Mistake:** Using generic regex rules for API endpoints without enforcing strict JSON schemas.
**Explanation:** APIs often accept complex nested objects. Regex rules may miss structural anomalies or type mismatches that lead to injection or deserialization attacks.
**Best Practice:** Configure WAF rules to validate payloads against the OpenAPI specification. Reject requests that deviate from the expected schema structure.

### 3. Host Header Manipulation Bypass
**Mistake:** Failing to validate the `Host` header, allowing attackers to send requests with a spoofed host that matches a different virtual host configuration.
**Explanation:** Attackers can manipulate the `Host` header to route traffic to unintended backend services or bypass WAF rules associated with a specific domain.
**Best Practice:** Enforce strict `Host` header validation in both the WAF and the application. Ensure the WAF only processes traffic for authorized domains.

### 4. High False Positives from Overly Broad Regex
**Mistake:** Using aggressive regular expressions that match legitimate user input.
**Explanation:** Overly broad rules (e.g., blocking any request containing `SELECT`) can block legitimate search queries or data submissions, causing user frustration and operational noise.
**Best Practice:** Tune rules based on actual traffic analysis. Use allow-listing for known safe patterns and restrict regex scope to specific contexts (e.g., SQL injection only in parameters expected to contain IDs).

### 5. TLS Termination Misconfiguration
**Mistake:** Allowing TLS termination at the origin server while the WAF is deployed in transparent mode.
**Explanation:** If the WAF cannot decrypt traffic, it cannot inspect the body for malicious payloads. The WAF only sees encrypted blobs, rendering it ineffective.
**Best Practice:** Ensure the WAF performs TLS termination. If end-to-end encryption is required, use mutual TLS (mTLS) with the WAF, or deploy the WAF as a sidecar proxy that terminates and re-encrypts traffic.

### 6. Static Rule Sets vs. Dynamic Threats
**Mistake:** Deploying WAF rules and never updating them.
**Explanation:** Attack techniques evolve rapidly. Static rule sets become obsolete, leaving the application vulnerable to new exploits.
**Best Practice:** Automate rule updates using managed rule sets (e.g., AWS WAF Managed Rules, Cloudflare Rules). Schedule regular reviews of custom rules and leverage behavioral analysis to detect anomalies without rule updates.

### 7. Performance Degradation Due to Unoptimized Rules
**Mistake:** Adding complex, nested regex rules or excessive custom logic without performance testing.
**Explanation:** WAF processing adds latency. Unoptimized rules can cause CPU spikes on the WAF nodes, increasing response times and potentially causing timeouts.
**Best Practice:** Profile rule performance. Prefer exact match and prefix matching over complex regex. Monitor WAF latency metrics and tune rules that contribute disproportionately to processing time.

## Production Bundle

### Action Checklist

- [ ] **Audit Attack Surface:** Map all public-facing endpoints, including APIs, GraphQL, and WebSocket connections, to ensure WAF coverage.
- [ ] **Enable Managed Rule Sets:** Activate OWASP CRS and vendor-managed rule sets for baseline protection against known vulnerabilities.
- [ ] **Configure API Schema Validation:** Define strict JSON schema validation rules for all API endpoints based on OpenAPI specs.
- [ ] **Set Up Origin Trust:** Configure the origin to accept traffic only from WAF IP ranges or via shared secret headers to prevent bypass.
- [ ] **Implement Detection Mode:** Deploy WAF in detection mode first; analyze logs for false positives and legitimate traffic patterns before enforcement.
- [ ] **Enable Rate Limiting:** Configure rate-based rules to mitigate credential stuffing, DDoS, and scraping attacks.
- [ ] **Integrate Logging:** Stream WAF logs to a SIEM for real-time alerting and historical analysis.
- [ ] **Test for Bypasses:** Conduct regular penetration testing to verify WAF effectiveness and identify bypass vectors.

### Decision Matrix

| Scenario | Recommended Approach | Why | Cost Impact |
|----------|---------------------|-----|-------------|
| **Startup / MVP** | Cloud WAF SaaS (e.g., Cloudflare, AWS WAF) | Rapid deployment, managed rules, low operational overhead. | Low setup, pay-as-you-go. |
| **Enterprise API Platform** | Context-Aware WAF + API Gateway | Deep API schema validation, bot management, high throughput. | Medium cost, high ROI via risk reduction. |
| **Legacy Monolith** | Open Source WAF (ModSecurity/Coraza) as Sidecar | Granular control, integration with existing infra, no vendor lock-in. | High engineering effort, low licensing cost. |
| **High-Volume E-commerce** | Managed WAF with Bot Management | Protection against scalping, inventory hoarding, and fraud. | Premium cost, essential for revenue protection. |

### Configuration Template

**Terraform Template: AWS WAF with CRS and Rate Limiting**

```hcl
resource "aws_wafv2_web_acl" "app_waf" {
  name        = "app-waf-${var.environment}"
  description = "WAF for production application"
  scope       = "REGIONAL" # Use CLOUDFRONT for global distribution

  default_action {
    allow {}
  }

  rule {
    name     = "AWSManagedRulesCommonRuleSet"
    priority = 1

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "AWSManagedRulesCommonRuleSet"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "RateLimitRule"
    priority = 2

    action {
      block {}
    }

    statement {
      rate_based_statement {
        limit              = 2000
        aggregate_key_type = "IP"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "RateLimitRule"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "app-waf-metrics"
    sampled_requests_enabled   = true
  }

  tags = {
    Environment = var.environment
  }
}

Quick Start Guide

1. Select WAF Provider: Choose a cloud-native WAF (AWS WAF, Azure WAF, GCP Cloud Armor) or a SaaS provider based on your infrastructure.
2. Attach to Resource: Associate the WAF with your load balancer, API Gateway, or CDN distribution. Ensure it is positioned at the edge of your network.
3. Enable Detection Mode: Activate the WAF in detection mode only. Do not enable blocking immediately. This allows you to observe traffic and identify potential false positives without impacting users.
4. Analyze Logs: Review WAF logs for blocked requests and false positives. Tune rules to whitelist legitimate traffic patterns and adjust thresholds.
5. Switch to Enforcement: Once logs indicate stable operation with minimal false positives, switch the WAF to enforcement mode. Monitor metrics continuously and adjust rules as needed.