Web application firewall for an online service
Disclosed herein are enhancements for operating a web application firewall to reduce load. In one implementation, a method of operating a content server for a web application comprising running a web accelerator with a plurality of threads on the content server. The method further provides receiving a request for content which will be provided to a web application, filtering the request and determining that the content will be requested from a second server. After determining that the content will be requested from a second server, reviewing the request with a web application firewall operating at a network layer 7 , forwarding the request, receiving the content, and providing the content. Further, the web application firewall is controlled by a plurality of sets of rules, which can be updated without restarting the web accelerator.
1. A method of operating a content server within an online service, comprising:
running a web accelerator with a plurality of threads on the content server;
receiving, at the content server, a request for content;
the content comprising data to be provided to a web application;
processing the request for the content on at least one of the threads, including:
filtering the request for the content;
determining that the content will be requested from a second server;
after determining that the content will be requested from the second server, reviewing the request for the content with a web application firewall (WAF);
forwarding the request for the content to the second server;
receiving the content from the second server; and
providing the content.
2. The method of claim 1 , wherein the second server is an origin server.
3. The method of claim 1 , wherein the second server is a second content server within the online service.
4. The method of claim 1 , wherein filtering the request for the content comprises comparing an address of a sender of the request for the content to a list of addresses.
5. The method of claim 1 , further comprising: After the step of receiving the content, but before the step of providing, reviewing the request for the content with a web application firewall (WAF) a second time.
6. The method of claim 1 , wherein the step of determining comprises using a hash table to determine whether the content is present in a cache in the content server.
7. A computer apparatus to operate a server within an online service, the computer apparatus comprising:
processing circuitry and a memory device, the memory device comprising processing instructions that direct the processing circuitry, when executed by the computer apparatus, to:
run a web accelerator with a plurality of threads on the server;
receive, at the server, a request for content;
the content comprising data to be provided to a web application;
process the request for the content on at least one of the threads, including:
filtering the request for the content;
determining that the content will be requested from a second server;
after determining that the content will be requested from the second server, reviewing the request for the content with a web application firewall (WAF);
forwarding the request for the content to the second server;
receive the content from the second server; and
provide the content.
8. The computer apparatus of claim 7 , wherein the second server is an origin server.
9. The computer apparatus of claim 7 , wherein the second server is a content server within the online service.
10. The computer apparatus of claim 7 , wherein filtering the request for the content comprises comparing an address of a sender of the request for the content to a list of addresses.
11. The computer apparatus of claim 7 , wherein reviewing the request for the content with a web application firewall (WAF) occurs immediately before forwarding the request for the content to the second server.
12. The computer apparatus of claim 7 , further comprising processing instructions that direct the server, when executed by the server, to: review the request for the content with a web application firewall (WAF) a second time after receiving the content, but before providing the content.
13. The computer apparatus of claim 7 , wherein determining that the content will be requested from a second server comprises using a hash table to determine whether the content is present in a cache in the server.
14. The computer apparatus of claim 7 , wherein determining that the content will be requested from a second server comprises using a hash table to determine whether the content is current in a cache in the server.
15. A server within an online service, the server comprising:
memory and a processor configured to:
run a web accelerator with a plurality of threads on the server;
receive a request for content;
the content comprising data to be provided to a web application;
process the request for content on at least one of the threads, including:
filtering the request for content;
determining that the content will be requested from a second server;
after determining that the content will be requested from the second server, reviewing the request for content with a web application firewall (WAF);
forwarding the request for the content to the second server;
receive the content from the second server; and
provide the content.
16. The server of claim 15 , wherein filtering the request for the content comprises comparing an address of a sender of the request for the content to a list of addresses.
17. The server of claim 15 , wherein reviewing the request for the content with a web application firewall (WAF) occurs immediately before forwarding the request for the content to the second server.
18. The server of claim 15 , wherein determining that the content will be requested from a second server comprises using a hash table to determine whether the content is present in a cache in the second server.
19. The method of claim 1 , wherein the wherein the step of determining comprises identifying that the request for content is a request for uncacheable content.
20. The method of claim 1 , wherein the wherein the step of forwarding the request for the content to the second server comprises forwarding the request for the content to a location within the online service.