0

I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with the basic understanding of firewalls. )

So when a client initiates say an HTTPS connection to the server, SSL termination happens before the traffic is sent over to the destination through the WAF (in a typical scenario). Now the WAF (my understanding is) is simply a reverse proxy with the additional capabilities (the rules that might have been configured on it to process the request) of inspecting the HTTP request message and taking certain actions.

The key point of confusion for me is the below:

The WAF is aware of the HTTP connection and the response from the destination is finally sent back to the client also through the same connection, that is coming through the WAF.

So my question is:

while I understand that a typical WAF is designed to only look at the HTTP request message & take actions on it, can't it be used to also inspect the response (that is already flowing through the same HTTP connection over which the request was made) and do certain transformations/processing of the response itself?

Improve this question
2
  • It is not fully clear to me what you are asking: Do you want to know if a WAF in theory could do this (because traffic flows through it anyway)? Or do you want to know if this is part of the feature set of existing WAF products? Just because a WAF could do this in theory does not mean that vendors have actually implemented it since there might be no attractive use case for this. Maybe it would be better if you could ask about a specific use case you want to use such feature for, instead of just a generic "transform/process response".
    – Steffen Ullrich
    Mar 4 at 16:11
  • @SteffenUllrich I wanted to know this more like in theory whether this was possible or not. And thanks, I understand that vendors may not do it for the lack of a profitable use case. My specific use case was to see if, for example, we could do simple string manipulations, like maybe output encoding, truncating trailing whitespaces, masking PII etc. in the response (conditionally as needed). Wanted to take that away from the backend & have it done at the WAF itself.
    – qre0ct
    Mar 7 at 8:01

2 Answers 2

Reset to default
1

Some companies do that. For instance, some hosting providers may inject advertising into the content of hosted web sites. Some companies replace any responses with status codes >= 500 with 500 or 503 and replace response body with some standard one.

Technically you can do that, too. But think first, if you really should do that.

If you modify response, you can break the application logic. Normally this would mean that you are trying to solve problems that actually the backend application should solve. If the application developers set particular response intentionally and you try to modify it, they will find another way to reach their goal. Instead of solving this may lead to hiding the problem.

Improve this answer
1

Yes.

A WAF is positioned between the client and the server, like so:

client  <-- tls -->  WAF  <-- tls -->  web server

So, the client's TLS connection is to the WAF. In other words, the WAF is basically a man-in-the-middle (MITM) between the client and the web server. Therefore, the WAF is in a position to do anything that an MITM can do, which includes modifying the response from the web server.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .