3 ms·
Sort of funny that one of CloudFlare products is Cloud Web Application Firewall. This 'enterprise-class' solution somehow for months failed to detect all sorts
by mixedbit 10y ago
Sort of funny that one of CloudFlare products is Cloud Web Application Firewall. This 'enterprise-class' solution somehow for months failed to detect all sorts of invalid and suspicious content being returned in index.htmls. It even has detection of 'Sensitive data exposure' listed as a feature. https://www.cloudflare.com/waf/ https://www.cloudflare.com/waf/
- homakov 10y agoFunny but totally expected, this kind of features is always snake oil with dead simple heuristics
- tyingq 10y agoThe way it's described makes it sound like the WAF looks solely at the request payload, and not the response. They mention using the default mod_security rules. I know mod_security can look at the response body, but it is not a default setting.