I would like to know peoples' thoughts as to whether a WAF is a perfectly acceptable compensating/alternative control to things like CSP, X-XSS-Protection, etc. I know WAF is suppose to protect against XSS and etc, but I been using Mozilla Observatory to rate sites and want to know if a WAF should be taken into consideration for the areas Observatory considers. https://observatory.mozilla.org/analyze/secure.verizon.com

1 Answer 1


Content-Security-Policy is an actual instruction to the browser of how a site should behave, specifically where potentially dangerous content can be loaded from and if potentially dangerous actions like inline script are allowed on this site.

A WAF is not a replacement for a strict Content-Security-Policy. A WAF will only apply heuristics to request and response in order to detect potential problems. How good these heuristics are depends on how good the WAF is tuned to the specific application it should protect, but they will usually not be as good as a strict Content-Security-Policy.

A WAF can never protect against attacks which cannot be observed within the HTTP request or response, specifically things like DOM XSS which only run inside the browser. Such things though can be prevented with a strict Content-Security-Policy.

A WAF can help in protect attacks, where the CSP cannot help though, like SQL injection. Still, it is based on heuristics only and proper input validation in the web application itself can be more correct simply because more information are available of what "correct" means.

Still, a WAF can be a valuable tool in a Defense in Depth strategy. But it should not be considered the ultimate and only defense.

Not the answer you're looking for? Browse other questions tagged .