Web Application Firewall
also called WAF
A filter in front of an application that inspects HTTP requests and blocks those matching known attack patterns — useful as a layer, dangerous as a substitute.
What it does well: block high-volume automated attacks, absorb known exploit attempts against frameworks, enforce rate limits, and — the most valuable capability — provide a virtual patch, a rule blocking exploitation of a specific vulnerability within minutes while the real fix is developed and deployed.
What it does badly: anything requiring application context. A WAF cannot know whether the caller is entitled to the record they requested, so it does nothing about broken object-level authorisation — which is the most common serious API vulnerability. Signature-based detection is also bypassable with sufficient effort, and produces false positives that block legitimate traffic.
Two cautions worth stating plainly. Misconfiguration is itself a vulnerability: the Capital One breach began with a misconfigured WAF permitting SSRF. And a WAF creates a temptation to defer fixes, where a blocking rule becomes the permanent remedy and the underlying flaw stays.
The defensible position: a WAF is a useful outer layer that buys time and reduces noise. It is not a control that permits weaker application security, and any rule added as a virtual patch should carry a ticket and a date for the real fix.