Skip to main content

Protect CDN resources with CDB WAAP

CDB Web Application and API Protection (WAAP) inspects HTTP traffic passing through a CDN resource and can block malicious requests before they reach the origin.

WAAP operates at the CDN resource level and protects all requests passing through the CDN, regardless of origin type. CDN resources that use CDB Object Storage as the origin require WAAP to be explicitly enabled in resource settings.

Enable WAAP for a resource

1. In the CDB Technical Web Portal, navigate to CDN > CDN resources.

2. Next to the resource that you want to protect with WAAP, click the three-dot icon and select Settings.

CDN resource three-dot menu showing management options

3. Scroll down the page and find the Security section.

4. Enable the WAAP toggle to activate Web Application and API Protection for your CDN resource.

Enable WAAP toggle in CDN resource creation form

5. Click Save to apply the changes.

It can take up to 20 minutes for HTTP traffic to start passing through WAAP after activation.

What to do if WAAP blocks content that shouldn't be blocked?

Instead of disabling WAAP protection for the whole resource, you can create a rule with an exception:

1. In the CDN resource settings, open the Rules tab.

2. Click Create rule > Create blank rule.

3. Give your rule a name.

4. In the Match criteria section, specify the URLs or a regular expression of files blocked by WAAP.

5. Set the origin pull protocol to Inherit from resource.

Create rule form showing Rule name, Match criteria, and Options sections

6. In the Options section, click Add option.

7. Find WAAP and then turn it off for the selected URL rule pattern.

8. Click Create rule.

WAAP is disabled for requests that match the rule pattern.

WAAP checks requests that pass through a Orange's CDN resource and can block attacks before they reach the origin. The switch is the waap option on the resource. A rule can turn that check off for one URL pattern.

An API token is required. The CDN resource ID is the id from the resources list call.

export GCORE_API_KEY="{YOUR_API_KEY}"
export CDN_RESOURCE_ID="{YOUR_CDN_RESOURCE_ID}"

Turn WAAP on

This call turns WAAP on for every request on the CDN resource. enabled and value are both required.

The call sets both fields to true.

A request that omits value returns HTTP 400. The JSON field is waap.

import os

from gcore import CDB

client = CDB()
resource_id = int(os.environ["CDN_RESOURCE_ID"])

updated = client.cdn.cdn_resources.update(
    resource_id,
    options={"waap": {"enabled": True, "value": True}},
)
saved = updated.options.waap
print(saved.enabled, saved.value, updated.waap_domain_id)

package main

import (
    "context"
    "fmt"
    "os"
    "strconv"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/cdn"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()
    resourceID, err := strconv.ParseInt(os.Getenv("CDN_RESOURCE_ID"), 10, 64)
    if err != nil {
        panic(err)
    }

    updated, err := client.CDN.CDNResources.Update(ctx, resourceID, cdn.CDNResourceUpdateParams{
        Options: cdn.CDNResourceUpdateParamsOptions{
            Waap: cdn.CDNResourceUpdateParamsOptionsWaap{
                Enabled: true,
                Value:   true,
            },
        },
    })
    if err != nil {
        panic(err)
    }
    saved := updated.Options.Waap
    fmt.Println(saved.Enabled, saved.Value, updated.WaapDomainID)
}

curl -X PATCH "https://api.cdb-staging.cdn.orange.com/cdn/resources/$CDN_RESOURCE_ID" \
  -H "Authorization: APIKey $GCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "options": {
      "waap": {
        "enabled": true,
        "value": true
      }
    }
  }'

The API returns HTTP 200. The saved option is:

{
  "enabled": true,
  "value": true
}

The resource response also includes waap_domain_id. A resource that uses CDB Object Storage as the origin needs this call. HTTP traffic can take up to 20 minutes to start passing through WAAP.

Turn WAAP off for one path

A rule turns WAAP off for paths that match ^/public/.*. ruleType 0 is a regular expression and must start with ^/ or /.

enabled true and value false turn WAAP off for that pattern. The resource setting stays on.

import os

from gcore import CDB

client = CDB()
resource_id = int(os.environ["CDN_RESOURCE_ID"])

rule = client.cdn.cdn_resources.rules.create(
    resource_id,
    name="waap-exception",
    rule="^/public/.*",
    rule_type=0,
    options={"waap": {"enabled": True, "value": False}},
)
saved = rule.options.waap
print(rule.id, saved.enabled, saved.value)

package main

import (
    "context"
    "fmt"
    "os"
    "strconv"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/cdn"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()
    resourceID, err := strconv.ParseInt(os.Getenv("CDN_RESOURCE_ID"), 10, 64)
    if err != nil {
        panic(err)
    }

    rule, err := client.CDN.CDNResources.Rules.New(ctx, resourceID, cdn.CDNResourceRuleNewParams{
        Name:     "waap-exception",
        Rule:     "^/public/.*",
        RuleType: 0,
        Options: cdn.CDNResourceRuleNewParamsOptions{
            Waap: cdn.CDNResourceRuleNewParamsOptionsWaap{
                Enabled: true,
                Value:   false,
            },
        },
    })
    if err != nil {
        panic(err)
    }
    saved := rule.Options.Waap
    fmt.Println(rule.ID, saved.Enabled, saved.Value)
}

curl -X POST "https://api.cdb-staging.cdn.orange.com/cdn/resources/$CDN_RESOURCE_ID/rules" \
  -H "Authorization: APIKey $GCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "waap-exception",
    "rule": "^/public/.*",
    "ruleType": 0,
    "options": {
      "waap": {
        "enabled": true,
        "value": false
      }
    }
  }'

The API returns HTTP 201. The saved option is:

{
  "enabled": true,
  "value": false
}

WAAP checks requests that pass through a CDN resource and can block attacks before they reach the origin. Declare the check with the Terraform provider v2. The waap option requires enabled and value, and HTTP traffic can take up to 20 minutes to start passing through WAAP after the option is stored.

Turn WAAP on

Set enabled and value to true so WAAP checks every request on the CDN resource, then run terraform apply. A resource that uses CDB Object Storage as the origin needs this option. The resource stores waap_domain_id.

resource "gcore_cdn_origin_group" "example" {
  name = "my-origin-group"

  sources = [
    {
      source  = "example.com"
      enabled = true
    }
  ]
}

resource "gcore_cdn_resource" "example" {
  cname           = "cdn.example.com"
  origin_group    = gcore_cdn_origin_group.example.id
  origin_protocol = "HTTPS"

  options = {
    waap = {
      enabled = true
      value   = true
    }
  }
}

Turn WAAP off for one path

A rule turns WAAP off for paths that match ^/public/.* while the CDN resource stays on. rule_type 0 is a regular expression and must start with ^/ or /. enabled true and value false store the exception. Run terraform apply. WAAP is disabled for requests that match the rule pattern.

resource "gcore_cdn_origin_group" "example" {
  name = "my-origin-group"

  sources = [
    {
      source  = "example.com"
      enabled = true
    }
  ]
}

resource "gcore_cdn_resource" "example" {
  cname           = "cdn.example.com"
  origin_group    = gcore_cdn_origin_group.example.id
  origin_protocol = "HTTPS"

  options = {
    waap = {
      enabled = true
      value   = true
    }
  }
}

resource "gcore_cdn_resource_rule" "public" {
  resource_id = gcore_cdn_resource.example.id
  name        = "waap-exception"
  rule        = "^/public/.*"
  rule_type   = 0

  options = {
    waap = {
      enabled = true
      value   = false
    }
  }
}