Architecture Overview
Enterprise WAF admin portal + reverse proxy. Controllers delegate to services — no direct database access from HTTP layer.
Layering
| Layer | Responsibility |
|---|---|
| Controllers | HTTP, ViewModels, [Authorize] policies |
| Services | Business logic, EF Core, audit, caching |
| Middleware | Proxy path, inspection, security headers |
| Infrastructure | YARP forwarder, DI, observability |
Enforced by automated architecture tests — controllers must not reference WafDbContext directly.
Proxied request flow
- Client →
WafReverseProxyMiddleware(resolve application by Host header) WafRequestInspectionService.InspectAsync- Protocol / smuggling checks (
WafProtocolSecurityService) - Geo block rules
- API Security layer when enabled (OpenAPI, JWT, BOLA heuristics)
- Virtual patches, bot/ML, positive security
- Detection modules (SQLi, XSS, SSRF, LFI, RFI, SSTI)
- Application rule engine (
IWafTrafficAnalysisService) - Rate limits & HTTP flood
- Decision: Allow / Block / Challenge → forward via YARP or return block page
- Traffic logged via
WafTrafficRecorderService
Fail-closed
- Inspection or rule-engine exceptions → treated as Block, not Allow.
- Regex evaluation uses
WafSafeRegexwith ~200ms match timeout (ReDoS mitigation). - Invalid OpenAPI schema JSON when configured → fail-closed on API Security layer.
SOC components (separation of concerns)
| Component | Role | Decides? |
|---|---|---|
| Incident | Record — what happened | No |
| Campaign | Correlation — grouped narrative | No |
| SOC Queue | Prioritization — where to start | No |
| Decision Engine | Allow / Block / Challenge | Yes |
| Explanation Layer | Why this decision | No (never changes enforcement) |
Analytics & scale path
Dashboards and geo map read through ITrafficAnalyticsStore (SQL today). Hot table: WafTrafficLogs. Cache tiers: ~60s real-time counters, 1m statistics, 5m attack reports.
Full engineering reference: product repository docs/waf/ARCHITECTURE.md (internal).