Security

Web Application Firewall (WAF)

A security control placed in front of a web application that inspects HTTP requests and blocks those matching known-bad patterns or rules. Because rules that match literal strings can be evaded by encoding or otherwise obfuscating a request, a WAF reduces attack surface but does not remove the underlying vulnerability.

Deep dive

Learn Article

Why URL Encoding Lets Attackers Slip Past String-Matching WAF Rules

A firewall that matches a literal path is defeated by a request spelling the same path differently. How percent-encoding creates a parser mismatch, and why you should normalize before deciding.

intermediate 5 min read

Back to glossary