Say that a web application is behind a well configured WAF, is there still a window of HTTP injection related attacks like SQLi, XSS, LFI, HTMLi?
If so is a WAF considered a redundant defence measure?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Absolutely, there are not perfect protections so there are new ways to do injection appearing from time to time and often there will be a windows of opportunity between when that new type of attacks is published and when it gets fixed or patched.
Many WAF's can do positive security which is a very strong protection against yet unknown attacks in many cases, that would require more configuration and maintenance but it can be very good for security.