Install the WAF

The ApiTraffic Web Application Firewall runs inside your application and inspects inbound requests before they reach your route handlers. Policies are managed in ApiTraffic and pushed to connected application instances automatically. The WAF is an optional addition to an existing ApiTraffic framework integration. It supports Express, Fastify, Koa, and Hapi.

Install

npm install @apitraffic/waf

yarn add @apitraffic/waf

pnpm add @apitraffic/waf

Add the middleware

Register the WAF after ApiTraffic and any middleware that parses request bodies, but before your routes. This lets the WAF inspect parsed request data and stop blocked requests before your application handles them.

Express
Fastify
Koa
Hapi

const express = require('express');
const apiTraffic = require('@apitraffic/express');
const waf = require('@apitraffic/waf');

const app = express();

app.use(express.json());
app.use(apiTraffic({
  token: process.env.API_TRAFFIC_TOKEN,
  bucket: process.env.API_TRAFFIC_BUCKET
}));
app.use(waf.express());

app.get('/api/users', (req, res) => {
  res.json({ users: [] });
});

const waf = require('@apitraffic/waf');

fastify.addHook('onRequest', waf.fastify());

const waf = require('@apitraffic/waf');

app.use(waf.koa());

const waf = require('@apitraffic/waf');

server.ext('onPreHandler', waf.hapi());

Middleware order matters. The WAF must run before your route handlers to prevent blocked requests from reaching application code.

Create a policy

Open WAF in the ApiTraffic dashboard.
Select Add WAF Policy.
Choose the environments and buckets the policy protects.
Start in Monitor mode. Matching requests continue normally while you review detections in WAF → Insights.
Change the policy to Enforcing when you are ready to block matching requests.

Policy changes are delivered to connected servers automatically. You do not need to redeploy your application when you tune a policy or change its mode.

Verify

Start your application and send normal traffic through a protected endpoint.
Open WAF → Insights and confirm that the application is reporting WAF activity.
Review detections while the policy is in Monitor mode before switching to Enforcing.

Disable the WAF locally

Set the environment variable below as an emergency, process-level kill switch:

.env

API_TRAFFIC_WAF_ENABLED=false

You can also disable it in code:

app.use(waf.express({ enabled: false }));

Both options make the middleware pass requests through without evaluating the active policy.

Get Started

Features

APM

WAF

Git Integration

Integrations

Install

Add the middleware

Create a policy

Verify

Disable the WAF locally

​Install

​Add the middleware

​Create a policy

​Verify

​Disable the WAF locally

Install

Add the middleware

Create a policy

Verify

Disable the WAF locally