Multi-layer chaining of web application firewalls

One or more non-transitory computer-readable media comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• receiving incoming traffic from one or more client devices at a reverse proxy, wherein the incoming traffic comprises a plurality of requests for an application hosted on a server, and the incoming traffic is received by a Web Application Firewall (WAF) between the one or more client devices and the application;
• operating a first filter in the WAF as a layer 7 (application layer) filter to inspect and analyze content of the plurality of requests;
• processing the content of the incoming traffic using the first filter in the WAF, wherein the first filter is configured to apply rules that identify suspicious traffic in the incoming traffic;
• passing the suspicious traffic from the first filter to one or more second filters in the WAF, and passing at least a portion of the incoming traffic that is not identified as suspicious traffic to the application, wherein the first filter, the one or more second filters, and the reverse proxy are integrated into a single software process, and the first filter provides the one or more second filters with the suspicious traffic within the single software process;
• processing the suspicious traffic using the one or more second filters, wherein the one or more second filters are configured to perform an Open Web Application Security Project (OWASP) compliant ruleset based WAF on the suspicious traffic to identify a first portion of the suspicious traffic that is allowed to reach the application;
• and
• rejecting, at the one or more second filters, a second portion of the suspicious traffic that is not allowed to reach the application and passing at least the first portion of the suspicious traffic to the application.

A load balancer and firewall comprising:

• one or more processors;
• and
• one or more memory devices comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving incoming traffic from one or more client devices at a reverse proxy, wherein the incoming traffic comprises a plurality of requests for an application hosted on a server, and the incoming traffic is received by a Web Application Firewall (WAF) between the one or more client devices and the application;
• operating a first filter in the WAF as a layer 7 (application layer) filter to inspect and analyze content of the plurality of requests;
• processing the content of the incoming traffic using the first filter in the WAF, wherein the first filter is configured to apply rules that identify suspicious traffic in the incoming traffic;
• passing the suspicious traffic from the first filter to one or more second filters in the WAF, and passing at least a portion of the incoming traffic that is not identified as suspicious traffic to the application, wherein the first filter, the one or more second filters, and the reverse proxy are integrated into a single software process, and the first filter provides the one or more second filters with the suspicious traffic within the single software process;
• processing the suspicious traffic using the one or more second filters, wherein the one or more second filters are configured to perform an Open Web Application Security Project (OWASP) compliant ruleset based WAF on the suspicious traffic to identify a first portion of the suspicious traffic that may be is allowed to reach the application;
• and
• rejecting, at the one or more second filters, a second portion of the suspicious traffic that is not allowed to reach the application and passing at least the first portion of the suspicious traffic that is not rejected to the application.