3 ms·
Yeah, and if I'm adding WAF to my application, I'd want it to be something I can run on a developer's laptop for fast iteration cycles -- Vagrant up, change WAF
by lotyrin 11y ago
Yeah, and if I'm adding WAF to my application, I'd want it to be something I can run on a developer's laptop for fast iteration cycles -- Vagrant up, change WAF rules, run the integration suite. If the WAF is up in the cloud, I guess I have to wait until staging the code to see if something legitimate gets snared by the WAF?
- dogma1138 11y agoYou can always run a reverse proxy in AWS behind a WAF that then points back to your development machine, it's a complicated solution but it's not new. If you host your servers internally and you are big organization you have WAF's/Application Firewalls, IPS/IDS, and possibility a DB FW like imperva as well. Does this lead to issues with deployments? yes, but it doesn't affect your code, if the WAF breaks you application 9/10 unless you use something silly like SQL queries in the URL (yes this has been seen before...) it's up to your security team to adjust the rule set during the pre-prod testing.