System and method for implementing a web application firewall as a customized service
A web application firewall (WAF) receives an application request from a router, wherein the application request is directed to a web application, and wherein the web application firewall is associated with the web application. The WAF updates the application request to include a first header, wherein the first header includes a copy of a uniform resource locator of the application request, and updates the uniform resource locator to indicate an address of the web application firewall. The WAF analyzes the application request to determine whether the application request is secure, wherein the analysis is based on a rule, and in response to a determination that the application request is secure, updates the application request to include a second header, wherein the second header includes an encrypted signature.
1. A method for efficiently protecting web applications, the method comprising:
receiving by a router, an application request, wherein the application request is directed to one of the web applications;
provisioning a web application firewall, including binding the web application firewall to the web application;
parsing the application request, wherein the parsing the application request includes identifying a first uniform resource locator;
adding a first header to the application request;
copying the first uniform resource locator to the first header;
updating the first uniform resource locator with a second uniform resource locator, wherein the second uniform resource locator includes an internet protocol address of the web application firewall;
routing the application request to the web application firewall, wherein the web application firewall is between the router and the web application;
determining a rule to apply to the application request, wherein the rule is associated with a security policy;
analyzing the application request to determine whether the application request is secure, wherein the analyzing is based on the rule, and wherein the analyzing the application request includes applying the rule to the application request;
in response to a determination that the application request is secure, transmitting the application request to the router by the web application firewall;
determining, by the router, whether the application request has been transmitted from the web application firewall; and
in response to the determining that the application request has been transmitted from the web application firewall, verifying that the application request is secure and routing the application request to the web application.
2. The method of claim 1 , further comprising in response to a determination that the application request is not secure, denying the application request.
3. The method of claim 1 , wherein the binding the web application firewall to the web application includes associating the security policy to the web application firewall and the web application.
4. The method of claim 1 , wherein the first uniform resource locator includes an internet protocol address of the web application.
5. The method of claim 1 , further comprising in response to the determining that the application request is secure, adding a second header to the application request, wherein the second header includes a signature to identify that the application request is secure, and wherein the signature is encrypted.
6. The method of claim 5 , wherein the signature is encrypted such that only the router can decrypt the signature.
7. The method of claim 6 , wherein the verifying that the application request is secure further includes decrypting the signature in the application request.
8. The method of claim 5 , wherein the verifying that the application request is secure further includes verifying whether the application request is within a timeout period.
9. A web application firewall comprising:
a memory coupled to a processor;
the processor configured to:
receive an application request from a router, wherein the application request is directed to a web application, and wherein the web application firewall is associated with the web application;
update the application request to include a first header, wherein the first header includes a copy of a uniform resource locator of the application request;
update the uniform resource locator to indicate an address of the web application firewall;
analyze the application request to determine whether the application request is secure, wherein the analysis is based on a rule;
in response to a determination that the application request is secure, update the application request to include a second header, wherein the second header includes an encrypted signature; and
transmit the application request to the router.
10. The web application firewall of claim 9 , wherein the rule is associated with the web application.
11. The web application firewall of claim 9 , wherein the web application firewall is between the router and the web application.
12. The web application firewall of claim 9 , wherein the second header is encrypted such that only the router can decrypt the second header.
13. A system for efficiently providing customized protection to a web application, comprising:
a cloud platform to host the web application;
a router to route an application request received to the web application;
a memory coupled to a processor; and
the processor configured to:
provision a web application firewall that includes the processor operable to bind the web application firewall to the web application;
parse the application request to identify a first uniform resource locator;
add a first header to the application request;
copy the first uniform resource locator to the first header;
update the first uniform resource locator with a second uniform resource locator, wherein the second uniform resource locator includes an internet protocol address of the web application firewall;
route the application request to the web application firewall, wherein the web application firewall is between the router and the web application;
determine a rule to apply to the application request, wherein the rule is associated with a security policy;
analyze the application request to determine whether the application request is secure based on the rule;
in response to a determination that the application request is secure, transmit the application request to the router;
determine, by the router, that the application request has been transmitted from the web application firewall; and
in response to a determination that the application request has been transmitted from the web application firewall, verify that the application request is secure and route the application request to the web application.
14. The system of claim 13 , wherein the processor is further configured to bind the web application firewall to the web application by associating the security policy to the web application firewall.
15. The system of claim 13 , wherein the processor is further configured to deny the application request in response to a determination that the application request is not secure.
16. The system of claim 13 , wherein the processor is further configured to add a second header to the application request, wherein the second header includes a signature to identify that the application request is secure.
17. The system of claim 16 , wherein the second header is encrypted such that only the router can decrypt the second header.