At a glance
- Did you know
- A WAF inspects HTTP requests for attacks such as SQL injection and cross-site scripting.
- Rule of thumb
- Run new rules in log-only mode first to see false positives before blocking.
- Watch out
- Rules off means attacks pass; strict rules block real users.
Its settings in ScaleMySystems
What you can change on it in the lab, and what each number does.
- Concurrency (slots)
- Calls it can work on at once (per instance when autoscaling). Needed slots ≈ calls per second × seconds each takes. Extra calls wait in the queue, then are rejected.
- Queue capacity
- Calls allowed to wait for a free slot. A bigger queue absorbs bursts but adds waiting time; 0 rejects straight away.
- Latency (p50) (ms)
- Typical time one call takes here, before any calls it makes itself. Slots are held for this long.
- Latency (p99) (ms)
- The slowest 1% of calls. Callers must set their timeout above this or they cut off healthy calls.
- Attack block rate
- Share of the attacks it covers that it stops. The rest pass through and are served like real users.
- False positives (real users blocked)
- Share of real users it wrongly blocks. Stricter rules raise the block rate and this together.
Problems that start with it
- The WAF blocks real users A strict WAF rule set blocks 4% of real users as attackers.
- Stripe: from launch build to real traffic A payments API on its first servers: no charge status cache, and the charges API, status API, fraud scoring, ledger and webhook delivery workers at an eighth of their real size. 1,500 requests a second: 70% charges that must never apply twice, 30% status checks. About half of all requests fail.
- Amazon storefront: from launch build to real traffic A storefront as first built: product pages read DynamoDB with no product cache, and the product, cart and checkout APIs, search, recommendations, the orders database, payments and fulfilment workers at an eighth of their real size. Shoppers arrive at real traffic and half of all requests fail, checkout included.
Full lesson coming soon
Lessons are being added one component at a time: how it works, its settings, a live exercise to break and fix it, interview questions and a short check. See the Circuit breaker lesson for what one looks like.