My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services.

We thought of doing this using a custom 'X-' request header, and then using AWS WAF's regex match conditions to check it against a 'non-trivial-to-guess' pattern.

I understand that this would give a very minimal level of protection; the idea is to prevent random browsing from search engines or easy access for anyone who knows the URL(s). That is, we don't need or expect to protect against informed or motivated attackers this way.

I can't find any precedent for this online. Are there any similar examples out there, or any better ways to achieve something similar to our goals? (Not meaningful security, but a first modicum of confidence in the request's origin)

  • 1
    Sounds a bit like white-listing IP addresses: keeps the casual riff-raff out, but someone determined can perhaps spoof them (depending on whether they need to see the reply). – TripeHound Sep 17 '19 at 8:17
  • 1
    FWIW, to prevent search engines, you can use robots.txt. A custom header (which, if it's not present, the server just 404s or something) would prevent automated crawling, but not a determined attacker. – Fund Monica's Lawsuit Sep 17 '19 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.