WAF Configuration: 5 Mistakes That Leave You Exposed

The Fix: Graduate to Block Mode with Staged Rollout

Don't flip from "log" to "block" overnight. Use a staged approach:

# Example: Cloudflare WAF staged rollout
# Week 1: Simulate mode, monitor logs
# Week 2: Block mode for high-confidence rules only
# Week 3: Block mode for medium-confidence rules
# Week 4: Block mode for all rules, with exceptions

# AWS WAF example - change from COUNT to BLOCK
{
  "Name": "SQLInjectionRule",
  "Priority": 1,
  "Action": {
    "Block": {}  # Changed from "Count": {}
  },
  "Statement": {
    "SqliMatchStatement": {
      "FieldToMatch": { "Body": {} },
      "TextTransformations": [
        { "Priority": 0, "Type": "URL_DECODE" }
      ]
    }
  }
}

Verification: After enabling block mode, check for increased 403 responses. If legitimate users complain, add targeted exceptions - don't revert to log mode.

The Fix: Narrow and Audit Bypass Rules

# BAD: Overly broad bypass
{
  "condition": "path starts with /api/",
  "action": "allow"  # Bypasses ALL WAF rules for API
}

# GOOD: Targeted exception for specific false positive
{
  "condition": "path equals /api/v1/upload AND method equals POST",
  "exception": ["rule-942100"],  # Only bypasses one specific rule
  "reason": "File uploads trigger SQLi false positive - JIRA-1234"
}

Audit checklist:

• List all bypass/exception rules
• Document why each exists (with ticket reference)
• Verify each is as narrow as possible
• Set calendar reminder to review quarterly

The Fix: Multi-Layer Rate Limiting

# Cloudflare rate limiting example
# Layer 1: Global rate limit
rate_limit:
  path: "/*"
  threshold: 1000/minute
  action: challenge

# Layer 2: Sensitive endpoint limits
rate_limit:
  path: "/api/login"
  threshold: 5/minute
  action: block
  
rate_limit:
  path: "/api/search"
  threshold: 30/minute
  action: block

# Layer 3: Per-user limits (if authenticated)
rate_limit:
  path: "/api/*"
  key: "header:Authorization"
  threshold: 100/minute
  action: block

Setting the right threshold:

1. Analyze normal traffic patterns for 2 weeks
2. Find 99th percentile request rate per IP
3. Set limit at 2-3x that value
4. Monitor and adjust based on blocked requests

The Fix: Enable Full Request Inspection

# AWS WAF - Enable body inspection with proper limits
{
  "SizeConstraintStatement": {
    "FieldToMatch": {
      "Body": {
        "OversizeHandling": "CONTINUE"  # Don't skip large bodies
      }
    },
    "ComparisonOperator": "LE",
    "Size": 65536,  # 64KB body inspection
    "TextTransformations": [
      { "Priority": 0, "Type": "NONE" }
    ]
  }
}

# ModSecurity - Enable request body access
SecRequestBodyAccess On
SecRequestBodyLimit 13107200      # 12.5MB limit
SecRequestBodyNoFilesLimit 131072 # 128KB for non-file content
SecRequestBodyLimitAction Reject

The Fix: Layer Custom Rules on Updated Defaults

# Custom rule examples

# Block requests with suspicious parameter patterns
{
  "name": "block-mass-assignment",
  "condition": "request.body contains 'isAdmin' OR 
                request.body contains 'role=' OR
                request.body contains 'permissions'",
  "action": "block",
  "endpoints": ["/api/users/*", "/api/profile"]
}

# Block known bad patterns specific to your stack
{
  "name": "block-graphql-introspection",
  "condition": "request.body contains '__schema' OR
                request.body contains '__type'",
  "action": "block",
  "endpoints": ["/graphql"]
}

# Rate limit password reset (business logic protection)
{
  "name": "rate-limit-password-reset",
  "condition": "path equals /api/password/reset",
  "rate_limit": "3 per hour per IP",
  "action": "block"
}

Rule update schedule: