We have a Java Spring Server, MongoDB and an Angular Frontend.

Some Application Security Configs:

  • TLS
  • Basic Authentication (Password Strength Policy)
  • XSS Protection (Content Security Policy)
  • CSRF Protection (Double Submit Cookie)

All important user data which they generate through chats, creating topics, etc... is end to end encrypted (E2EE).

Now our hosting company can add a WAF (Web Application Firewall) to the Server Setup.

From the hoster's advertisement:

OWASP Top 10 Protection:

  • Bot-Access Control
  • Remote File Inclusion
  • Illegal Resource Access- SQL Injection
  • Blocking policy (block request, block IP, block session)


Do we need WAF if most of our data is E2EE? What would be the benefit of it in our setup?

  • Judging from your question, you appear to be attempting to purchase "Security in a Box". All the things you mentioned are, or at least can be, useful in the right context. The real question is your architecture details, which we don't see. If this project has significant value, I encourage you to engage a good security analysis. We could question and speculate indefinitely, but this is not the way to go about it. – user10216038 Oct 24 '19 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.