1

My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services.

We thought of doing this using a custom 'X-' request header, and then using AWS WAF's regex match conditions to check it against a 'non-trivial-to-guess' pattern.

I understand that this would give a very minimal level of protection; the idea is to prevent random browsing from search engines or easy access for anyone who knows the URL(s). That is, we don't need or expect to protect against informed or motivated attackers this way.

I can't find any precedent for this online. Are there any similar examples out there, or any better ways to achieve something similar to our goals? (Not meaningful security, but a first modicum of confidence in the request's origin)

Improve this question
2
  • 1
    Sounds a bit like white-listing IP addresses: keeps the casual riff-raff out, but someone determined can perhaps spoof them (depending on whether they need to see the reply).
    – TripeHound
    Sep 17, 2019 at 8:17
  • 1
    FWIW, to prevent search engines, you can use robots.txt. A custom header (which, if it's not present, the server just 404s or something) would prevent automated crawling, but not a determined attacker.
    – anon
    Sep 17, 2019 at 13:42

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .