Web Application Firewalls (WAF): What They Do and How They Work

Why Your Web App Needs More Than a Firewall

You have a traditional network firewall, but your web application still gets attacked. Why? Because network firewalls operate at layers 3 and 4, inspecting IP addresses and ports. They cannot tell the difference between a legitimate login request and a SQL injection payload hidden in a form field. That's where a Web Application Firewall (WAF) comes in.

A WAF sits between your users and your web server, analyzing HTTP/HTTPS traffic at layer 7. It inspects requests and responses for patterns that indicate attacks—like SQL injection, cross-site scripting (XSS), or malicious file uploads—and blocks them before they reach your application.

What Exactly Does a WAF Do?

Think of a WAF as a security guard for your web traffic. Its core functions include:

• Filtering malicious requests: It examines headers, cookies, query strings, and POST bodies for known attack signatures.
• Enforcing security policies: You define rules—like blocking requests from certain countries or limiting request sizes.
• Protecting against OWASP Top 10: Many WAFs come with pre-configured rule sets to mitigate common vulnerabilities such as injection, broken authentication, and sensitive data exposure.
• Rate limiting and bot mitigation: It can throttle excessive requests from a single IP or block known malicious bots.
• Logging and alerting: It records blocked requests for analysis and can trigger alerts on suspicious activity.

Importantly, a WAF is not a silver bullet. It complements secure coding practices but does not replace them. A well-configured WAF can, however, provide a critical layer of defense, especially for legacy applications or during zero-day exploits.

How WAFs Work: The Technical Underpinnings

WAFs analyze traffic using two primary methods: signature-based detection and anomaly-based detection.

Signature-Based Detection

This method relies on a database of known attack patterns. For example, a rule might look for the string ' OR '1'='1 in a query parameter, which is a classic SQL injection attempt. Signature-based WAFs are fast and effective against known threats but can miss novel attacks.

Anomaly-Based Detection

Anomaly-based WAFs build a baseline of normal traffic and flag deviations. For instance, if a user suddenly submits a 10MB POST request to a login endpoint, that's anomalous. This approach can catch unknown attacks but may generate false positives.

Most modern WAFs combine both methods, often using machine learning to improve accuracy. They also parse HTTP requests into components (method, URL, headers, body) and apply rules to each part.

Deployment Options: Where Does a WAF Live?

You can deploy a WAF in several ways, each with trade-offs:

For most modern web apps, a cloud-based WAF or a host-based solution like ModSecurity is the practical choice. Cloud WAFs are particularly attractive for small teams because they handle infrastructure and rule updates.

Key WAF Rule Sets and the OWASP Core Rule Set

If you use ModSecurity, you'll likely pair it with the OWASP Core Rule Set (CRS). The CRS is a set of generic attack detection rules that provide protection against the OWASP Top 10. It includes rules for:

• SQL injection
• Cross-site scripting
• Local file inclusion
• Remote code execution
• PHP injection
• Session fixation

However, the CRS can be aggressive. You'll need to tune it to avoid blocking legitimate traffic. Start in detection-only mode, review logs, and gradually enable blocking rules.

How to Set Up a Basic WAF with ModSecurity and Nginx

Here's a simplified example of deploying ModSecurity with Nginx on Ubuntu. This gives you a host-based WAF.

1. Install ModSecurity and the Nginx connector:

   sudo apt install libmodsecurity3 libnginx-mod-http-modsecurity

2. Enable the module in Nginx: Add load_module modules/ngx_http_modsecurity_module.so; to the top of /etc/nginx/nginx.conf.
3. Download the OWASP CRS:

   git clone https://github.com/coreruleset/coreruleset.git /etc/nginx/modsec/coreruleset

4. Configure ModSecurity: Create /etc/nginx/modsec/main.conf with:

   Include /etc/nginx/modsec/modsecurity.conf
   Include /etc/nginx/modsec/coreruleset/crs-setup.conf
   Include /etc/nginx/modsec/coreruleset/rules/*.conf

5. Enable ModSecurity in your server block:

   server {
       modsecurity on;
       modsecurity_rules_file /etc/nginx/modsec/main.conf;
       ...
   }

6. Test and reload Nginx:

   sudo nginx -t && sudo systemctl reload nginx

After setup, monitor /var/log/modsec_audit.log for blocked requests. Tune rules by adding exclusions for false positives.

WAF Limitations and Best Practices

A WAF is not foolproof. Attackers can bypass WAFs using encoding tricks, obfuscation, or by exploiting logic flaws that signatures don't catch. Also, a WAF cannot protect against attacks that don't go through HTTP, like direct database access.

To get the most out of your WAF:

• Keep rules updated: New vulnerabilities emerge regularly; update your rule sets.
• Monitor and tune: Regularly review logs and adjust rules to reduce false positives.
• Use it as part of a defense-in-depth strategy: Combine with secure coding, regular patching, and least-privilege access.
• Test your WAF: Use tools like OWASP ZAP or Burp Suite to see if your WAF blocks common attacks.

FAQ

Can a WAF replace secure coding practices?

No. A WAF is a supplementary layer. It can block many attacks, but vulnerabilities in your code can still be exploited if the WAF is bypassed or misconfigured. Always follow secure coding guidelines.

Will a WAF slow down my website?

It can add slight latency, especially if it's cloud-based or performs deep inspection. However, modern WAFs are optimized, and the security benefits usually outweigh the minor performance impact. Host-based WAFs like ModSecurity can be tuned for performance.

How do I choose between a cloud WAF and a self-hosted WAF?

Consider your budget, team expertise, and compliance needs. Cloud WAFs are easier to set up and scale, while self-hosted WAFs offer more control and keep data on your infrastructure. For small teams, cloud WAFs are often more practical.

Ready to analyze your Nginx logs and see what attacks your WAF is blocking? Use our free Nginx Log Analyzer to parse and visualize your logs quickly.