DevOps portal — Web firewall¶
Everything public goes through the web firewall (WAF): every app whose route is Public, through the web firewall or Internal and public is a site on it. There's nothing to request separately: publishing, making an app internal again and the WAF settings are all done in Apps.
The sites list¶
Web firewall lists one site per public app:
| Column | Shows |
|---|---|
| Hostname, Team, Namespace, Env | Where the site is |
| Status | publishing until the WAF serves it, then live; failed with the reason; unpublishing while a change takes it off the internet |
| Mode | detect or block |
| Certificate | When the certificate expires, or why the check failed |
The portal flags a site that needs attention: a certificate failing or within 21 days of expiry, a production site still in detect after 7 days, and an exception past its review date.
A site's drawer shows its WAF settings (from the app), a chart of requests and blocks over the last 24 hours, the newest WAF events (without query strings) and its exceptions. Rate limits, bot policy and timeouts are managed by platform in the WAF's own console.
Detect and block¶
| Mode | What the WAF does |
|---|---|
| Detect | Logs what it would block, lets everything through. New sites start here |
| Block | Blocks it |
Start in detect, watch the events for false positives (and request exceptions for them), then Switch to blocking. Back to detect turns blocking off again.
| Switch | Who can | Approval |
|---|---|---|
| To block | Developers outside prod, owners in prod | A team owner, unless you are one |
| Back to detect, dev and qa | Developers | A team owner, unless you are one |
| Back to detect, prod | Owners | Type the hostname to confirm; platform approves |
The switch is an app change that sets only the mode, so it shows on Changes and takes effect once merged. Once an app is public, its mode can only be changed here, not in the app form.
Exceptions¶
When the WAF flags legitimate traffic, ask for an exception: one rule turned off for one path.
- In the site's drawer, click Not an attack? next to the event (it fills in the rule and path) or Request an exception.
- Fill in:
- Rule id, from the event.
- Path starts with: as narrow as you can; not
/on its own. - Only this parameter (optional): limit it to one request parameter, or leave it empty for the whole request.
- Why this is legitimate traffic.
- Expires: in 30 days, in 90 days, or never (reviewed every 90 days).
- Platform approves it, since it weakens the WAF, then adds it in the WAF and marks it added. It takes effect on the WAF's next apply, and the exception shows as active.
Platform is reminded weekly about exceptions waiting to be added.
Removing an exception needs no approval: remove it in the drawer, and platform takes it out of the WAF. Expired exceptions are removed automatically. An exception that never expires needs a review every 90 days: an owner marks it Reviewed to keep it.
Developers and owners can request and remove exceptions, in every environment.