# What is a Web Application Firewall (WAF)?

> A web application firewall (WAF) is a security control that inspects HTTP and HTTPS traffic between clients and web applications and applies policy.

- Canonical URL: https://yellowcube.eu/glossary/web-application-firewall/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It is commonly deployed as a reverse proxy, gateway feature, cloud edge service, or filtering component near the application. Unlike a conventional network firewall, a WAF can reason about application-layer elements such as methods, paths, headers, cookies, parameters, and message bodies.

WAF policies may use attack signatures, protocol validation, allowlists, reputation, rate controls, or behavioral signals. This can reduce exposure to common injection, traversal, scripting, and protocol attacks and provide temporary “virtual patching” while an application fix is prepared. Useful protection depends on correct traffic routing, visibility into encrypted content, current rules, application-specific tuning, and review of alerts.

### Key points

- **Choose the enforcement point:** Ensure protected traffic cannot bypass the WAF and define where TLS is terminated, inspected, and re-established.
- **Start with policy objectives:** Identify applications, APIs, sensitive paths, expected methods and content types, size limits, and abuse cases before enabling broad blocking.
- **Tune and test:** Use representative traffic, staged enforcement, exclusions with owners and expiry dates, and regression tests to manage false positives and false negatives.
- **Integrate operations:** Send useful events to monitoring, correlate them with application and identity evidence, maintain escalation paths, and validate changes after releases.
- **Important limitation:** A WAF cannot repair vulnerable code or reliably recognize every broken authorization rule, business-logic abuse, compromised account, direct backend path, or attack hidden in unsupported protocols. It is a compensating layer, not proof of application security.

### Related terms

[Application programming interface (API) security](<https://yellowcube.eu/glossary/application-programming-interface-security/>) · [Application security](<https://yellowcube.eu/glossary/application-security/>) · [Reverse proxy](<https://yellowcube.eu/glossary/reverse-proxy/>) · [Firewall](<https://yellowcube.eu/glossary/firewall/>) · [Virtual patching](<https://yellowcube.eu/glossary/virtual-patching/>) · [Open Worldwide Application Security Project (OWASP) Top 10](<https://yellowcube.eu/glossary/open-worldwide-application-security-project-top-10/>) · [Structured Query Language (SQL) injection](<https://yellowcube.eu/glossary/structured-query-language-injection/>) · [Runtime application self-protection (RASP)](<https://yellowcube.eu/glossary/runtime-application-self-protection/>)

### Sources

[NIST glossary: WAF](https://csrc.nist.gov/glossary/term/WAF) · [NIST SP 800-228 update 1: Guidelines for API Protection for Cloud-Native Systems](https://csrc.nist.gov/pubs/sp/800/228/upd1/final) · [OWASP Core Rule Set](https://owasp.org/www-project-modsecurity-core-rule-set/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.