Design a web application firewall
PremiumSecurity systemMedium
- OWASP CRS
- Anomaly scoring
- Virtual patching
Quick answer
This security system interview question asks you to design a web application firewall. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design a web application firewall (WAF) that runs in edge proxies in front of 30,000 customer websites and APIs, like the managed WAFs that CDNs and clouds offer. It inspects every HTTP request and blocks attacks such as SQL injection. The hard parts are catching evasion without blocking real users and adding almost no latency.
Customers turn on a managed rule set, write their own rules (block a path, allow an office IP, limit login attempts) and need an emergency rule within minutes when a new vulnerability is announced. One bad rule pushed everywhere could block millions of real requests, so rule changes are as risky as code deploys.
What must a web application firewall do?
- Inspect and decide: Check method, URL, query, headers, cookies and the first 128 KB of the body, then allow, log, block (403) or rate-limit (429).
- Managed and custom rules: Sites enable the managed rule set and add their own rules plus exceptions scoped to a path, parameter and rule ID.
How well must it do it?
- Latency: Inspection adds under 1 ms p99 per request.
- Safe changes: A bad rule must be caught and rolled back before it touches more than 1% of traffic.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- OWASP CRS
- Anomaly scoring
- Virtual patching
- Request normalisation
- Rate limiting
- Reverse proxy
How you’ll practise
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design a web application firewall and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Medium. Entry-level engineers can practise it, but it expects you to reason about requirements and trade-offs, not only list components.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team