Implementing a WAF in Azure

Web and API applications are popular workload types to host in Azure virtual networks. They are also frequently targeted by malicious attacks exploiting well-known vulnerabilities such as SQL injection, cross-site scripting, and code injection. To complement secure coding practices for web application development, a WAF can be deployed at the network perimeter as an additional layer of protection against these types of exploits and vulnerabilities. Azure WAF is not a standalone service in Azure. Instead, it is a capability that can be integrated into two Azure traffic management services – Azure Application Gateway and Azure Front Door.

Azure Application Gateway is a regional-level application delivery service that can be deployed with a WAF to protect public-facing or internal workloads in an Azure virtual network. It can be deployed into a designated subnet within our Azure virtual networks, and we can apply a WAF policy to it (see Figure 8.57...