1

I want to protect a web app behind some other application. This application should only let users through after they authenticated. While this is a common use case for Web Application Firewalls it seems. I want the WAF to try out filling username and password and determine if those are valid by seeing if the web app redirects to the welcome page.

What kind of programs are able to do this? Is there a name or term for this strategy? Is there anything that would speak against this strategy?

Improve this question
4
  • 3
    You want your WAF to perform a weak and awkward authentication by interacting with the front end and not the back end. Why? What do you want to protect against? This strategy is simply "authentication". That's what you are doing. What WAFs can do is to actually perform valid authentication. Why are you wanting to make this a separate "hacky" layer?
    – schroeder ♦
    Oct 11, 2022 at 11:31
  • Well sometimes there is the case where the IT Infrastructure does not exist to validate with the backend. Ok probably there is a way to validate in the backend or check in the database but this application does not have any standardised interfaces to do oauth, OpenID or what so evever.
    – Alex
    Oct 12, 2022 at 6:26
  • I was looking for "Forward Proxy Authentication" it turns out or "Forward auth"
    – Alex
    Oct 14, 2022 at 9:43
  • What you describe in your question is not satisfied by Forward Proxy Authentication. I'm glad that foward auth will help you out, but it does not meet what you stated you wanted.
    – schroeder ♦
    Oct 14, 2022 at 13:27

0

Reset to default

Browse other questions tagged .