How the web application firewall works

The G8KEPR web application firewall (WAF) inspects incoming API and MCP requests and can block or flag requests that match known attack patterns. It runs as a managed rule engine, so you get coverage for common web and API threats without writing or maintaining rules yourself.

How requests are evaluated

Each request passes through the rule engine in order:

1. 1.Normalize the request — the engine decodes and canonicalizes the URL, headers, query string, and body so evasion tricks like double-encoding or mixed casing are less likely to slip past a rule.
2. 2.Match the normalized request against the built-in rule set for each attack class.
3. 3.Score and decide — a request that matches a high-confidence rule is blocked; lower-confidence matches are flagged for review rather than dropped.
4. 4.Log the outcome so it appears in your dashboard with the matched attack class and the action taken.

Attack classes the built-in rules cover

The managed rule set targets the most common ways APIs are abused:

• ▸Injection — SQL injection and command injection attempts against your endpoints.
• ▸Cross-site scripting (XSS) — script payloads embedded in request parameters or bodies.
• ▸Path traversal and local file inclusion — attempts to reach files outside the intended scope, such as ../../etc/passwd.
• ▸Server-side request forgery (SSRF) — requests crafted to make your service call internal or metadata endpoints.
• ▸Protocol and request anomalies — malformed requests, header smuggling, and oversized or malformed payloads.
• ▸Automated abuse — scanner signatures and high-volume patterns that indicate scraping or brute-force activity.

What you control

• ▸Actions per class — choose whether a matched class is blocked outright or logged for review.
• ▸Allowlisting — exempt trusted sources or specific endpoints when a legitimate request resembles an attack pattern.
• ▸Monitoring — review blocked and flagged requests, grouped by attack class, from your dashboard.

The WAF complements G8KEPR's AI and MCP threat detection: the WAF handles conventional web and API attacks, while the AI-layer engines focus on prompt-injection and model-abuse patterns. See API keys and authentication to secure the endpoints the WAF protects.