Web Application Firewall Decision Lab
Switch between clean traffic, exploit probes, and tuning exceptions to see how parsing, scoring, and enforcement shape what reaches the origin.
Route: POST /api/checkout
POST /api/checkout HTTP/1.1
Host: shop.example.eu
Content-Type: application/json
Cookie: session=4f91b2
{"cartId":"cart_7841","paymentMethod":"card","coupon":"SUMMER10"}method=POST path=/api/checkout content_type=application/json json.cartId=cart_7841 json.paymentMethod=card json.coupon=SUMMER10
No protocol anomalies. No injection signatures. Body fields match the expected purchase shape.
protocol 0 + exploit syntax 0 + reputation 0 = 0
Allow immediately.
The origin receives the checkout request and continues with stock checks and payment authorisation.
Keep this kind of high-volume normal request in dashboards so new rules are measured against a real baseline instead of intuition.
Start with the raw request. At this point the WAF has network and HTTP bytes, not a verdict. The first job is to capture the same request the application would otherwise process.
A healthy WAF should be boring on ordinary traffic. Good protection still means fast, quiet allows for clean requests.
Active route: POST /api/checkout
Arrow keys to navigate · R to reset
Tap dots to jump to any step