A Web Application Firewall or WAF secures web applications by monitoring and checking HTTP traffic between a web application and the Internet. It commonly shields web applications from attacks, such as, file inclusion, cross-website scripting (XSS), cross-site forgery, and SQL injection, among others. A WAF is a protocol layer 7 defense (in the OSI model), and isn't intended to safeguard against a wide range of attacks. This strategy for attacks alleviation is typically part of a suite of apparatuses which together make an all encompassing safeguard against a scope of attack vectors.

By sending a WAF before a web application, a shield is put between the web application and the Internet. While an proxy server ensures a client devices personality by utilizing a delegate, a WAF is a kind of invert intermediary, shielding the server from exposure by having clients go through the WAF before achieving the server.

A web application firewall works through a lot of guidelines frequently called policies. These policies expect to secure against vulnerabilities in the application by sifting through vindictive traffic. The estimation of a WAF comes to some degree from the speed and simplicity with which strategy alteration can be executed, taking into account quicker reaction to differing attack vectors; amid a DDoS assault, rate restricting can be immediately actualized by adjusting WAF policies.

A web application firewall varies from a conventional network firewall in its capacity to assess information at the application level—for instance, by validating form field input or securing application cookies. A network firewall and a web application firewall are by and large install together and give complementary dimensions of security.

Types of WAF:

Host-based WAFs might be completely incorporated into the application code itself. The advantages of a host-based WAF usage incorporate lower cost and expanded customization options. Host-based WAFs can be a difficult task to oversee because they require application libraries and rely on nearby server assets to run viably. In this way, more staff assets, including that of system analyst, developers and devops/devsecops, might be required.

Cloud-hosted WAFs offer a budget-friendly solution for companies that want a turnkey item that requires negligible resources for usage and the executives. Cloud WAFs are easy to install, are accessible on a membership premise and frequently require just a basic DNS or proxy change to divert application traffic. In spite of the fact that it can be difficult to place responsibility regarding filtering companies web application traffic with an third-party provider, the technique enables applications to be ensured over a wide range of facilitating areas and utilize comparable approaches to secure application layer attacks. Moreover, these third-parties have the most recent danger insight and can help recognize and obstruct the most recent application security dangers.

Network based WAFs are normally equipment based and can diminish inactivity since they are installed locally, on premise through a dedicated machine, as near the application as possible. Many network based WAF vendors permit replication of policies and settings over various machines, thereby making heavy deployment, management and configuration possible. The greatest downside for this kind of WAF item is operational and maintenance cost.