WAF
acronymnetworkingsecurity
Stands for: Web Application Firewall
A filter that inspects web traffic and blocks application-layer attacks.
A Web Application Firewall sits in front of an app and looks inside HTTP, stopping injection, cross-site scripting, and similar attacks that a network firewall cannot see. It is protection at layer 7, tuned to the shape of web requests rather than ports and addresses.
A WAF earns its keep in the gap between deployment and patching. When a vulnerability is disclosed on a Friday and the fix cannot ship until the next release train, a rule at the edge is the difference between an exposed application and a contained one. That framing matters, because a WAF is often sold as prevention and actually delivers time.
The operational reality is tuning. A policy that blocks nothing is theatre, and a policy that blocks legitimate traffic gets disabled by the first team whose checkout page breaks. Everything difficult about running one lives between those poles: distinguishing an attack from an unusual but valid request, deciding whether to block or log, and resisting the urge to switch to blocking mode everywhere on day one.
The adversarial dimension is what keeps it interesting. Attackers know a WAF is there and shape payloads to slip past it, using encoding, fragmentation, and parser differences between the WAF and the application behind it. That last category is the deep one: when two pieces of software disagree about what a request means, the disagreement itself is the vulnerability.
Also known as: waf, web application firewall, app firewall