Web application firewall

{{see also| Application firewall}}

Dedicated web application firewalls entered the market in the late 1990s during a time when web server attacks were becoming more prevalent.

Early WAF products, from Kavado and Gilian technologies, were available, trying to solve the increasing amount of attacks on web applications in the late 1990s.{{cn|date=October 2024}} In 2002, the open-source project ModSecurity{{cite web |title=ModSecurity homepage |url=https://www.modsecurity.org/ |website=ModSecurity}} was formed in order to make WAF technology more accessible. They finalized a core rule set for protecting web applications, based on OASIS Web Application Security Technical Committee’s (WAS TC) vulnerability work. In 2003, they expanded and standardized rules through the Open Web Application Security Project’s (OWASP) Top 10 List, an annual ranking for web security vulnerabilities. This list would become the industry standard for web application security compliance.{{cite web |url=https://www.veracode.com/blog/2012/04/what-is-owasp-guide-to-the-owasp-application-security-top-10 |title=What is OWASP? Guide to the OWASP Application Security Top 10 |publisher=Veracode |date= 25 April 2012 |first=Neil |last=DuPaul |access-date=10 April 2018}}{{cite web |url=https://www.itproportal.com/features/the-owasp-top-ten-and-todays-threat-landscape/ |title=The OWASP Top Ten and Today's Threat Landscape |publisher=ITProPortol |date=12 March 2018 |first=Daniel |last=Svartman |access-date=10 April 2018}}

Since then, the market has continued to grow and evolve, especially focusing on credit card fraud prevention. With the development of the Payment Card Industry Data Security Standard (PCI DSS), a standardization of control over cardholder data, security has become more regulated in this sector. According to CISO Magazine, the WAF market was expected to grow to $5.48 billion by 2022.{{Cite web |last=Harsh |date=2021-12-26 |title=Web Application Firewall (WAF) Market CAGR of 19.2% 2021 |url=https://firewallauthority.com/web-application-firewall-market-cagr-of-2021/ |access-date=2021-12-26 |website=Firewall Authority |language=en-US}}{{cite web |url=https://www.cisomag.com/web-application-firewall-market-worth-5-48-billion-2022/ |title=Web Application Firewall Market Worth $5.48 Billion by 2022 |publisher=CISO Magazine |date=5 October 2017 |access-date=10 April 2018 |archive-date=11 April 2018 |archive-url=https://web.archive.org/web/20180411025845/https://www.cisomag.com/web-application-firewall-market-worth-5-48-billion-2022/ |url-status=dead}}

A web application firewall is a special type of application firewall that applies specifically to web applications. It is deployed in front of web applications and analyzes bi-directional web-based (HTTP) traffic{{snd}} detecting and blocking anything malicious. The OWASP provides a broad technical definition for a WAF as “a security solution on the web application level which{{snd}} from a technical point of view{{snd}} does not depend on the application itself”.{{cite web |author1=Maximillan Dermann |author2=Mirko Dziadzka |author3=Boris Hemkemeier |author4=Alexander Meisel |author5=Matthias Rohr |author6=Thomas Schreiber |title=OWASP Best Practices: Use of Web Application Firewalls ver. 1.0.5 |url=https://www.owasp.org/index.php/Category:OWASP_Best_Practices:_Use_of_Web_Application_Firewalls/Version_1.0.5 |website=OWASP |language=en |date=July 7, 2008}} According to the PCI DSS Information Supplement for requirement 6.6, a WAF is defined as “a security policy enforcement point positioned between a web application and the client endpoint. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. It may be a stand-alone device or integrated into other network components.”{{cite web |author1=PCI Data Security Standards Council |title=Information Supplement: Application Reviews and Web Application Firewalls Clarified ver. 1.2 |url=https://www.pcisecuritystandards.org/documents/information_supplement_6.6.pdf |website=PCI DSS |date=October 2008}} In other words, a WAF can be a virtual or physical appliance that prevents vulnerabilities in web applications from being exploited by outside threats. These vulnerabilities may be because the application itself is a legacy type or was insufficiently coded by design. The WAF addresses these code shortcomings by special configurations of rule-sets, also known as policies.

Previously unknown vulnerabilities can be discovered through penetration testing or via a vulnerability scanner. A web application vulnerability scanner, also known as a web application security scanner, is defined in the SAMATE NIST 500-269 as “an automated program that examines web applications for potential security vulnerabilities. In addition to searching for web application-specific vulnerabilities, the tools also look for software coding errors.”{{cite web |author1=Paul E. Black |author2=Elizabeth Fong |author3=Vadim Okun |author4=Romain Gaucher |title=NIST Special Publication 500-269 Software Assurance Tools: Web Application Security Scanner Functional Specification Version 1.0 |url=https://samate.nist.gov/docs/webapp_scanner_spec_sp500-269.pdf |website=SAMATE NIST |date=January 2008}} Resolving vulnerabilities is commonly referred to as remediation. Corrections to the code can be made in the application, but typically a more prompt response is necessary. In these situations, the application of a custom policy for a unique web application vulnerability to provide a temporary but immediate fix (known as a virtual patch) may be necessary.

WAFs are not an ultimate security solution, rather they are meant to be used in conjunction with other network perimeter security solutions such as network firewalls and intrusion prevention systems to provide a holistic defense strategy.

WAFs typically follow a positive security model, a negative security, or a combination of both as mentioned by the SANS Institute.{{cite web |author1=Jason Pubal |title=Web Application Firewalls – Enterprise Techniques |url=https://www.sans.org/reading-room/whitepapers/application/web-application-firewalls-35817 |website=SANS Institute |publisher=SANS Institute InfoSec Reading Room |format=PDF |date=March 13, 2015}} WAFs use a combination of rule-based logic, parsing, and signatures to detect and prevent attacks such as cross-site scripting and SQL injection. In general, features like browser emulation, obfuscation and virtualization, and IP obfuscation are used to attempt to bypass WAFs.{{cite web |author1=IPM |title=Reverse Engineering how WAFs Like Cloudflare Identify Bots |url=https://www.ipm-corporation.com/research/reverse-engineering-how-the-waf-industry-identifies-bots |website=IPM Corporation |date=July 29, 2022}} The OWASP produces a list of the top ten web application security flaws. All commercial WAF offerings cover these ten flaws at a minimum. There are non-commercial options as well. As mentioned earlier, the well-known open-source WAF engine called ModSecurity is one of these options. A WAF engine alone is insufficient to provide adequate protection, therefore OWASP along with Trustwave's Spiderlabs help organize and maintain a Core-Rule Set via GitHub{{cite web |title=Core-Rule Set Project Repository |url=https://github.com/coreruleset/coreruleset |website=GitHub |date=30 September 2022 }} to use with the ModSecurity WAF engine.{{cite web |title=OWASP ModSecurity Core Rule Set Project |url=https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project#tab=Main |website=OWASP}}

Although the names for operating mode may differ, WAFs are basically deployed inline in three different ways. According to NSS Labs, deployment options are transparent bridge, transparent reverse proxy, and reverse proxy.{{cite web |title=TEST METHODOLOGY Web Application Firewall 6.2 |url=https://www.nsslabs.com/index.cfm/research-advisory/library/content-security/web-application-firewalls/waf-test-methodology-v6-2/waf-test-methodology-v6-2/ |website=NSS Labs |date= |access-date=2018-05-03 |archive-date=2022-09-05 |archive-url=https://web.archive.org/web/20220905014256/https://www.nsslabs.com/index.cfm/research-advisory/library/content-security/web-application-firewalls/waf-test-methodology-v6-2/waf-test-methodology-v6-2/|url-status=dead}} "Transparent" refers to the fact that the HTTP traffic is sent straight to the web application, therefore the WAF is transparent between the client and server. This is in contrast to reverse proxy, where the WAF acts as a proxy, and the client’s traffic is sent directly to the WAF. The WAF then separately sends filtered traffic to web applications. This can provide additional benefits such as IP masking but may introduce disadvantages such as performance latencies.

JA3, developed by Salesforce in 2017,{{Cite web |title=JA3 – A method for profiling SSL/TLS Clients |website=GitHub |url=https://github.com/salesforce/ja3 }} is a technique for generating a unique fingerprint for SSL/TLS traffic based on specific fields in the handshake, such as the version, cipher suites, and extensions used by the client. This fingerprint enables the identification and tracking of clients based on the characteristics of their encrypted traffic. In the context of distributed denial of service (DDoS) protection, JA3 fingerprints are used to detect and differentiate malicious traffic, often associated with attack bots, from legitimate traffic, allowing for more precise filtering of potential threats.{{Cite book |title=Operationalizing Threat Intelligence A Guide to Developing and Operationalizing Cyber Threat Intelligence Programs |isbn=9781801818667 |last1=Wilhoit |first1=Kyle |last2=Opacki |first2=Joseph |date=17 June 2022 |publisher=Packt Publishing }} In September 2023, AWS WAF announced built-in support for JA3, enabling customers to inspect the JA3 fingerprints of incoming requests.{{Cite web |title=AWS WAF now supports JA3 Fingerprint Match |url=https://aws.amazon.com/about-aws/whats-new/2023/09/aws-waf-ja3-fingerprint-match/ }} JA3 was deprecated in May 2025 in favor of [https://github.com/FoxIO-LLC/ja4 JA4].

• Application firewall
• Payment Card Industry Data Security Standard (PCI DSS)
• Web application
• Software as a service (SaaS)
• Computer security
• Network security
• Application security
• Web application security

{{Reflist}}

{{Computer security}}

Category:Firewall software

Category:Web applications