A web application firewall (WAF) is software that checks each request sent to a website or web application, and blocks the requests that carry an attack. A request is the message a browser sends to a website, for example when you search, log in or fill in a form. The WAF reads the contents of every request before it reaches the website's servers.
The best-known attack it stops is SQL injection. Most websites keep their data in a database, and they ask the database for data in a language called SQL. A badly written website puts whatever the user types straight into its SQL commands. So an attacker types part of an SQL command into a form, instead of a name. The database then runs the attacker's command. It may return every customer's records, or let the attacker log in without a password. Another common attack is cross-site scripting. The attacker places harmful code on a page, and the code then runs in other visitors' browsers.
The WAF recognises such attacks by rules. Many rules are based on the OWASP Top 10, a widely used list of the ten most critical security risks to web applications. The WAF maker updates the rules all the time.
Take, for example, the online ordering website of a restaurant chain in Lucknow. At 1 a.m., someone types a short SQL command into the login box, instead of a phone number. The WAF recognises the pattern and blocks the request, so it never reaches the database. The WAF logs the attempt and sends it to the SIEM.
Rules can also block real customers by mistake. Say a customer named Ms D'Souza types her surname into the delivery form. The apostrophe in her name is also a character used in SQL injection. A badly tuned rule blocks her order. So teams first run each new rule in a mode that only records matches. They switch on blocking after they have checked what the rule would have stopped.
A WAF can also block attacks on a flaw until the flaw is fixed. Say a CVE, a publicly listed flaw, is found in the shopping-cart software that the website uses. The developers need a week to install the fix. Meanwhile, the WAF maker adds a rule that blocks attempts to use the flaw. This is called virtual patching.
The WAF usually runs in a security company's cloud, together with the content delivery network (CDN), or on the company's own load balancers. It is different from a next-generation firewall, which checks the connections of the company's own staff. Some attacks look exactly like normal requests, so WAF rules cannot catch them. API security catches misuse of an app's APIs, and bot management catches scripts.