WAF (web application firewall)
web application firewall · application firewall · WAAP · virtual patching · virtual patch
A filter placed in front of a website or API that inspects each web request and blocks those that look like attacks (SQL injection, XSS, abusive bots).
In practice
A WAF understands HTTP, whereas a network firewall only sees addresses and ports. It applies generic rules, often modelled on the OWASP Top 10 risks, plus rules specific to the application. It also acts as a “virtual patch”, blocking exploitation of a flaw while the code is being fixed. But a WAF can be bypassed: it reduces risk, it replaces neither secure development nor patching.
Fictional case: an online shop discovers a SQL injection in its search engine on a Friday evening. The team adds a targeted WAF rule in twenty minutes, then ships the code fix on Tuesday. The WAF covered the weekend; the fixed code closes the flaw for good.
