I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with the basic understanding of firewalls. )
So when a client initiates say an HTTPS connection to the server, SSL termination happens before the traffic is sent over to the destination through the WAF (in a typical scenario). Now the WAF (my understanding is) is simply a reverse proxy with the additional capabilities (the rules that might have been configured on it to process the request) of inspecting the HTTP request message and taking certain actions.
The key point of confusion for me is the below:
The WAF is aware of the HTTP connection and the response from the destination is finally sent back to the client also through the same connection, that is coming through the WAF.
So my question is:
while I understand that a typical WAF is designed to only look at the HTTP request message & take actions on it, can't it be used to also inspect the response (that is already flowing through the same HTTP connection over which the request was made) and do certain transformations/processing of the response itself?