We have a Java Spring Server, MongoDB and an Angular Frontend.
Some Application Security Configs:
- Basic Authentication (Password Strength Policy)
- XSS Protection (Content Security Policy)
- CSRF Protection (Double Submit Cookie)
All important user data which they generate through chats, creating topics, etc... is end to end encrypted (E2EE).
Now our hosting company can add a WAF (Web Application Firewall) to the Server Setup.
From the hoster's advertisement:
OWASP Top 10 Protection:
- Bot-Access Control
- Remote File Inclusion
- Illegal Resource Access- SQL Injection
- Blocking policy (block request, block IP, block session)
Do we need WAF if most of our data is E2EE? What would be the benefit of it in our setup?