WAF’s intention is to catch common attacks. I was also skeptical about it until I saw Azure application gateway WAF’s default policies to fend off log4j attacks

WAF’s intention is to catch common attacks. I was also skeptical about it until I saw Azure application gateway WAF’s default policies to fend off log4j attacks. My take is now to configure WAF at a generic level with minimal impact on application functionalities. And yes, the value of WAF’s is overrated. Cause with proper development guidelines like using ORM instead of writing plain SQL queries, you can throw away half of the default policies which revolve around SQL injections. For large organizations, having a WAF does add some value. With security it’s all about adding layers of protection wherever possible.