Web Application Firewall (WAF)
What it is
Azure Web Application Firewall (WAF) is a protection layer for web traffic. It evaluates HTTP(S) requests against managed and custom rules before those requests reach the web application. Azure WAF is available with services including Application Gateway and Azure Front Door.
Why it exists
Network controls such as an NSG can allow or deny a connection by address, port, and protocol. They do not understand a URL, cookie, query string, or HTTP header. WAF sees those web-request details, which makes it useful against common attacks such as SQL injection and cross-site scripting.
Key ideas
- Managed rules provide maintained protections for common web-attack patterns. A match is a signal to investigate, not proof of a successful attack.
- Custom rules add organization-specific matching, allow/block, or rate-limit logic. They need testing: an overbroad rule can block real customers.
- Detection mode records matches; prevention mode blocks matching requests. A sensible rollout observes and tunes a policy before relying on it to block production traffic.
- Placement matters. Choose Application Gateway WAF for regional, VNet-integrated layer-7 delivery; consider Azure Front Door WAF for globally distributed edge delivery.
- WAF is a layer, not a cure-all. It complements secure code, patching, identity controls, logging, and DDoS Protection.
Northwind example
Northwind places a WAF policy in front of its public ordering site. In detection mode, the team sees that a new managed rule flags an unusual but legitimate product-search query. Maya tunes the policy before moving it to prevention mode. Later, a request with a clear SQL-injection pattern is blocked before it reaches the ordering app. Northwind still fixes vulnerabilities in its code; WAF reduces exposure but does not make insecure code safe.
Exam lens
If the requirement names web requests, HTTP(S), common web exploits, or layer-7 filtering, prefer WAF. If it names ports, subnets, or VM NICs, begin with NSG or Azure Firewall instead. If it names a traffic flood intended to exhaust a public service, include DDoS Protection in the design.
Related
application-gateway · azure-front-door · nsg · azure-firewall