Title

The API must use Web Application Firewall (WAF). (Cat II impact)

Discussion

The API must be protected by a Web Application Firewall (WAF) or an API Gateway that monitors and filters incoming and outgoing traffic to prevent injection attacks, ensuring malicious inputs are detected and blocked.

Check Content

Verify the API is configured to use a WAF or API Gateway to manage traffic. If the API is not configured to use a WAF or API Gateway in accordance with organization-defined security policies, this is a finding.

Fix Text

Build or configure the API to use a WAF or API Gateway to manage traffic.

Additional Identifiers

Rule ID: SV-274769r1143807_rule

Vulnerability ID: V-274769

Group Title: SRG-APP-000516

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.