advanced

WAF and edge protection

Use WAF rules, bot controls, DDoS mitigation, allowlists, challenge flows, and false-positive monitoring as one layer of application defense.

Web Application Firewalls inspect HTTP traffic for OWASP-style attack patterns: SQLi probes, XSS payloads, path traversal, oversized bodies, and known bot signatures. DDoS mitigation absorbs volumetric attacks before they reach origin.

WAF rules run in allow/block/challenge modes. Start in log-only or count mode, tune false positives, then enforce. Combine with rate limits and geo blocks — not as sole security.

					Internet → DDoS scrubbing → WAF → CDN/LB → Origin (Node)

False positives block legitimate API clients (mobile apps with unusual User-Agent, JSON that matches SQL patterns). Maintain runbooks to bypass rules per route during incidents.

On interviews: position WAF as defense-in-depth, not replacement for input validation; explain tuning trade-offs; how Node apps should still validate behind WAF.

Common pitfalls: blocking webhooks from partners; aggressive OWASP paranoia breaking GraphQL or rich JSON; no monitoring of WAF block reasons.

Checklist:

Roll out WAF rules gradually with metrics.
Exempt trusted webhook paths with mTLS or signatures.
Correlate WAF blocks with app error rates.
Keep origin validation regardless of edge blocks.