20.2.1. Web Application Firewall

20.2 Secure Development

WAF

- (Web Application Firewall):

- A digital bouncer for your website.

- It sits in front of your web app, checking all incoming web traffic.

- Its job is to block common online attacks, especially those trying to send malicious code or data to your app.

### 🛠 What Does a WAF Protect Against?

- ✅ Cross-Site Scripting ([[XSS]])

- ✅ SQL Injection (SQLi)

- ✅ Information Disclosure

- ✅ Other OWASP Top 10 vulnerabilities

XSS

**Cross-Site Scripting

A type of attack where a hacker injects malicious code (usually JavaScript) into a legitimate website, which then runs in other users' web browsers without their knowledge, often to steal information.

Attacks the user's browser, trying to steal their info or control their web experience.

Information Disclosure

A security flaw where an application or system accidentally reveals sensitive data (like error messages with internal details, or private user information) to people who shouldn't see it.

OWASP

(Open Worldwide Application Security Project):

A global group of security experts who create free tools and guides to help make software safer.

SQL Injection

An attack where a hacker inserts malicious code into data inputs (like a login form) to trick a website's database into revealing, changing, or deleting sensitive information.

Attacks the website's back-end database, trying to steal or mess with stored data.