WAF

Cloudflare WAF filters HTTP traffic at the edge with managed rulesets, custom expressions, bot management, and rate limiting. For Node.js APIs behind Cloudflare you layer WAF in front of Express/Fastify while still validating auth and input in application code — WAF is not a substitute for app security.

| Layer | Example | |-------|---------| | Managed rules | OWASP-style SQLi, XSS signatures | | Custom rules | Block admin paths from non-office IPs | | Rate limiting | Cap `POST /login` per IP or cookie | | Bot fight mode | Challenge suspicious automation |

Start new rules in log/simulate mode, review false positives on real traffic, then enforce. Coordinate with CDN cache so blocked responses are not cached as 200.

On interviews: managed vs custom rules, rate limit keys, false-positive handling, WAF vs app-layer validation, and protecting webhooks or mobile clients.

Common pitfalls: blocking legitimate crawlers or CI smoke tests; rate limits keyed only by IP behind NAT; caching error pages; admin paths exposed without IP or mTLS constraints.

The trade-off is automated attack blocking versus operational noise, false positives, and rule maintenance cost.

Checklist:

• Simulate rules before enforce in production.
• Rate limit sensitive auth and write endpoints.
• Keep app validation regardless of WAF.
• Monitor blocked request logs for false positives.