WAF blokuje SQL injection, XSS, bot traffic na aplikační vrstvě. Defense-in-depth vrstva.

ModSecurity + OWASP CRS¶

Nginx¶

modsecurity on; modsecurity_rules_file /etc/modsecurity/crs/crs-setup.conf; modsecurity_rules_file /etc/modsecurity/crs/rules/*.conf;

AWS WAF¶

resource “aws_wafv2_web_acl” “main” { default_action { allow {} } rule { name = “aws-managed” statement { managed_rule_group_statement { vendor_name = “AWS” name = “AWSManagedRulesCommonRuleSet” } } } }

Klíčový takeaway¶

WAF je defense-in-depth, ne náhrada za bezpečný kód. Začněte s managed rules.