0

QUESTION
Can WAF be used to protect a web application that requires a user to authenticate with a 3rd party identity provider before accessing any of the resources?

Motivation for asking the question
I would like my custom application to be protected by a firewall so that I can create rules that will protect my application from nefarious requests. When I read about WAF it sounded like the right solution. I became concerned when I read that WAF must be used in conjunction with AWS CloudFront and CloudFront can only cache publicly accessible content. I began to wonder if CloudFront's limitation to cache private content would prevent my WAF rules from being applied to requests destined for private content.

Background Information
I have created a custom web application that is hosted on an AWS EC2 instance. The web application contains dynamic content and supports HTTP GET/OPTIONS/POST/PUT/DELETE verbs. The custom web application requires every user to authenticate with an identity provider. If an unauthenticated user tries to access a resource their browser will redirect to a publicly accessible sign in page hosted by the web application. From the sign in page the user may choose an identity provider. Once the identity provider has been chosen the user's browser will be redirected to the identity provider's login dialog where they will be prompted to enter their credentials. Once authenticated they will be redirected back to the requested resource within the web application.

dustfinger
  • 31
  • 3
  • *"CloudFront can only cache publicly accessible content."* This isn't quite accurate, but it also isn't necessarily applicable -- CloudFront is "officially" (marketed) for caching, as a CDN, but it has a number of valid use-cases where caching is actually disabled. It likely *is* possible to use CloudFront with WAF for your application... but what is the general nature of the nefarious requests you are specifically trying to protect against? – Michael - sqlbot Aug 04 '16 at 16:39
  • The motivation for WAF is the following: 1. Protect against OWASP top 5. 2. Apply lambda function to detect potential DDOS attacks and then block by IP addresses. 3. ability to add rules to protect against vulnerabilities that we learn about over time and with gained experience. To be effective WAF would need to apply rules to URI and query strings accessible only to authenticated users. The caching at edge locations via CoudFront is a nice bonus, but not the primary objective. – dustfinger Aug 05 '16 at 16:08

0 Answers0