What my WAF actually blocked, and what my app already stops on its own
A request arrives at your server for /api/vehicles/1' OR '1'='1 . Before a single line of your application code runs, something in front of it reads that string, recognises the shape of a SQL injection attempt, and answers 403. That something is a web application firewall, and last month I spent a weekend trying to work out whether mine was actually earning its place. First, what the thing…
My web application firewall (WAF) blocked twelve out of twenty-six attack payloads, demonstrated during a weekend project to test its effectiveness. A WAF is software that sits in front of a web server, inspecting requests for signs of attacks like SQL injection or cross-site scripting before they reach the application. In this case, mine is a ModSecurity module integrated into an existing NGINX web server, avoiding additional costs and infrastructure.
The WAF employs the OWASP Core Rule Set, a community-developed collection of security patterns focused on common web vulnerabilities.
There are three key benefits to using a WAF: defense in depth, virtual patching, and compliance with auditing standards. It acts as an additional layer of protection, blocking attacks before they reach the application code, and can quickly mitigate known vulnerabilities while a fix is developed. Lastly, many WAFs are required for compliance with regulations such as PCI DSS. However, it is important to remember that a WAF is a compensating control, not a guarantee of security on its own.
To validate its performance, I set up two identical production-mode instances of my Next.js and NestJS application, one with the WAF active and the other disabled. I then sent twenty-six different attack payloads across six categories through both versions, measuring the differences. Production behavior was essential, as development mode had different security settings that could skew the results.
The WAF successfully blocked twelve of the payloads, but I discovered that the application itself already rejected five of those, blocking them before the WAF even had a chance to act.
Only seven of the attacks were previously accepted by the application without being rejected by either the WAF or the application logic. While this may seem concerning, it is essential to understand that the application handled these payloads safely. Two of the accepted payloads were cross-site scripting (XSS) attempts, which were rendered harmless by the application's built-in output encoding.
The remaining five accepted payloads were accepted because the application treated them as valid requests and processed them accordingly, without any security breach. This demonstrates that the WAF's blocking of these payloads did not add any additional security benefit, as the application was already handling them securely.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
