WAF policies

Goal

Create a WAF policy, attach it to an application, and roll it out safely without breaking legitimate traffic.

What a policy contains

A WAF policy is an ordered list of rules. Each rule combines:

• Conditions — matches on method, path, headers, query, body, client IP, geo, or reputation
• Action — allow, block, challenge, or log
• Scope — which applications or routes the rule protects

Built-in protections cover the usual suspects: SQL injection, cross-site scripting, path traversal, malformed requests, and known-bad user agents.

Safe rollout: detect first

Never turn a new policy straight to blocking on production traffic.

1. Create the policy with rules in detection (log-only) mode.
2. Send real traffic through it for a few days.
3. Review matches in the logs; tune away false positives (usually an over-broad path or body pattern).
4. Switch rules to block one group at a time.

Steps

1. Open Policies in the console and create a policy for your application.
2. Enable the baseline protection rule groups in detection mode.
3. Attach the policy to the application route.
4. After tuning, flip to blocking and publish.

Verify

• A test request with an obvious injection payload (' OR 1=1-- in a query parameter) is logged, then blocked once you enable blocking.
• Normal application flows produce no matches.

Pitfalls

• Blocking APIs that legitimately send SQL-looking text (e.g. code snippets) — scope body rules to the routes that need them.
• Forgetting that policy changes need a publish to reach the proxy.