A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-Site Scripting (XSS) and SQL Injection.

So from what I understand, this will handle only HTTP. What will happen if HTTPS traffic goes through the WAF?

Does it reduce the request time? or are there any performance issues?

  • 1
    Is your question about performance or security? – schroeder Jun 16 at 14:28
  • I want to know, is it reduce the performance? – Prasath Jun 16 at 14:58
  • That's not a security question, then. – schroeder Jun 16 at 15:51
  • I can see that the statement ...is an application firewall for HTTP applications can be confusing. In my opinion it would have been better to use the term web applications and leave the protocol out of it. – Jeroen Jun 16 at 16:06
  • 1
    Adding any security filtering will negatively impact performance. Especially at the application layer. – user2320464 Jun 16 at 16:46

Browse other questions tagged or ask your own question.