A web application firewall sits in front of a web application and inspects requests before application code handles them.
It may live at a cloud edge or as a reverse proxy, and a side path that skips it makes the control irrelevant.
How it works
Placement lets it block hostile patterns, enforce size limits, and log attacks that never reach the server process.
The application still has to enforce its own rules after a request is allowed through.
What this firewall cannot understand about business logic is a separate topic.
Here the question is position: every public request should meet the firewall before the origin.
Concrete examples
- A cloud edge inspects requests and only then forwards them to the origin.
- A reverse proxy blocks a wave of malformed requests before they reach application code.
- An origin address left open on the internet lets clients skip the firewall entirely.
Protective measures
- Force every public request through the firewall before it reaches the application.
- Hide origin addresses so clients cannot connect around the control.
- Log both blocked and allowed requests for later review.
- Test regularly that no direct path to the application remains open.