The web application firewall may not be attached to the listener, may run in detection-only mode, or may be bypassed by traffic that is passed at layer 4 or carried over an upgraded WebSocket connection. Malformed or exploit payloads then reach backend targets without inspection, compromising the integrity and availability of those targets.
Application-Layer Inspection Is Absent or Bypassed
CCC.LB.TH12
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.LB.CP03 | Layer 7 Routing | The service can distribute incoming traffic based on application layer (OSI layer 7) information. Some of the supported protocols on layer 7 are HTTP/2, HTTP/3, HTTPS, gRPC, and WebSockets. |
| CCC.LB.CP04 | Layer 4 Routing | The service can distribute incoming traffic based on transport layer (OSI layer 4) information, using the combination of IP addresses and TCP/UDP ports rather than inspecting the content of the packets. |
| CCC.LB.CP07 | WebSocket Support | The service can proxy WebSocket connections between clients and backend targets. |
| CCC.LB.CP23 | Web Application Firewall Integration | The service can integrate with a web application firewall so that only legitimate traffic reaches backend servers, blocking malicious requests. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.LB.CN11 | Attach a Web Application Firewall to Internet-Facing Listeners | Ensure that application-layer traffic from the internet is inspected and filtered before it reaches backend targets. |