« first day (5025 days earlier)      last day (14 days later) » 

PythonForEver
PythonForEver
8:11 AM
What's wrong with the use of a WAF (Web Application Firewall)? - are the answers a bit too anti-WAF sided? Assuming a "reputable" WAF (e.g. Azure) when all my services live in Azure, am I wrong to think the benefit is greater than the risk?
Also, how do I prevent botnet/Tor IPs from bruteforcing/scanning my API without IP-reputation systems (WAF anti-bot rulesets).
 
4 hours later…
CaffeineAddiction
CaffeineAddiction
12:41 PM
@PythonForEver I would say the answers are mixed ... @schroeder even requested "citation needed".

I think it largly depends on the WAF you are using, and how it is being used. If you are using a third party cloud service as a WAF ... it could be a liability. If you are slapping on WAF on your unsecure product as a bandaid ... it could be a liability. If you are hosting a well known community based WAF on your own infrastructure as an additional layer of security on your already secure api ... it could be useful.
> how do I prevent botnet/Tor IPs from bruteforcing/scanning my API without IP-reputation systems
By only exposing the 1x api call to login ... everything else gives a 404 till you have a valid token from your login.
I would also say context is important ... if someone was hosting an 6 year old instance of wordpress and slapping on a third party SAS WAF ... I would laugh them out of the room.

If someone wrote their own API for something, locked it down as hard as they could ... and then added an Apache / Nginx reverse proxy server w/ an up to date version of [ModSecurity ](https://modsecurity.org) running ... I would pay attention.
PythonForEver
PythonForEver
1:09 PM
@CaffeineAddiction ModSecurity is quite interesting.
My WAF will be used as an extra layer of security, not as a bandaid.
Not sure i understood the 1x API /login call.
As in, a rate-limit per IP of 1? Resets in 60s I guess? That would affect legitimate users which may fail to log 2 times in a row.
Also there are endpoints that don't require a token, e.g. password reset.
 
3 hours later…
CaffeineAddiction
CaffeineAddiction
4:04 PM
> Not sure i understood the 1x API /login call.
as in, there is nothing to scan ... a request to foo.com/api/real_api responds the exact same as a call to foo.com/api/doesnt_exist ... till you have a valid auth token
so they can scan you all they want ... but will not get any info other than foo.com/api/auth ... until their request has a valid auth token

« first day (5025 days earlier)      last day (14 days later) »