Problems / Security, medium

The WAF blocks real users

A strict WAF rule set blocks 4% of real users as attackers.

Solve it in the labTake it as a mock interview

Unlock it once for 15 credits; everything inside it is free (runs, changes, Submit, results, hints). Sign in with Google to start; new accounts get free credits.

Your goals

Success ≥ 99%.

Test cases

Like a coding problem, a solution has to pass every case, not just the one it was built for. Submit in the lab runs all 5; 1 of them are hidden until then.

  1. As given. The problem’s own traffic, scheduled failures and seed.
  2. Peak hour. 25% more traffic than the problem states, with the same failures.
  3. A slow dependency. The main data store or model answers twice as slowly for part of the run.
  4. A server dies. One replica of the service with the most replicas is killed for part of the run.

The traffic

1,500 requests a second for 30 seconds: 90% reads, 10% writes.

The system

What each component does in this design, and what calls it. The simulator mimics each one from these settings.

ComponentIts job hereSettings
DDoS protectionDDoS protectionTraffic enters here.Calls WAF.Volumetric floods are absorbed at the network edge, spread over many locations, before they reach you.100000 slots
WAFWAFDDoS protection forwards to it.Calls Bot management.A WAF inspects HTTP requests for attacks such as SQL injection and cross-site scripting.100000 slots
Bot managementBot managementWAF forwards to it.Calls Load balancer.Bot managers score clients by behaviour and fingerprint, not by IP address alone.100000 slots
Load balancerLoad balancerBot management forwards to it.Calls API.Layer 4 balancers route by IP and port; layer 7 balancers read HTTP and can route by path or header.–
APIApp serviceLoad balancer forwards to it.Calls Postgres.Little's law: throughput ≈ concurrency ÷ latency. 200 slots at 50 ms serve about 4,000 req/s.4 replicas × 200 slots · timeout 2.0 s
PostgresSQL databaseAPI calls it.Postgres runs one process per connection, which is why poolers like PgBouncer sit in front of busy databases.4 vCPU · 60 connections

More security problems