WAF with Application Gateway in Azure - Step-by-Step Execution

Process Flow - WAF with Application Gateway

Client sends HTTP request

↓

Application Gateway receives request

↓

WAF inspects request

↓

Threat?

↓

Block/Alert

↓

Backend processes request

↓

Response sent back to Client

The Application Gateway receives client requests, the WAF inspects them for threats, blocks or alerts if threats are found, otherwise forwards to backend servers.

Execution Sample

Azure

1. Client sends HTTP request
2. Application Gateway with WAF inspects request
3. If threat detected, block request
4. Else, forward request to backend
5. Backend sends response

This flow shows how a request passes through the Application Gateway with WAF inspecting and deciding to block or forward.

Process Table

Step	Action	Request Content	WAF Decision	Result
1	Receive request	Normal HTTP GET /home	No threat detected	Forward to backend
2	Backend processes	Request forwarded	N/A	Response generated
3	Send response	Response from backend	N/A	Response sent to client
4	Receive request	HTTP POST with SQL injection	Threat detected	Request blocked
5	Block request	Blocked by WAF	N/A	Client receives block message

💡 Execution stops when request is either forwarded to backend or blocked by WAF.

Status Tracker

Variable	Start	After Step 1	After Step 4	Final
Request Content	None	Normal HTTP GET /home	HTTP POST with SQL injection	Blocked or forwarded
WAF Decision	None	No threat detected	Threat detected	Block or forward
Result	None	Forward to backend	Request blocked	Response sent or block message

Key Moments - 2 Insights

Why does the WAF block some requests but not others?

The WAF inspects the request content for threats like SQL injection. If it detects a threat (see execution_table step 4), it blocks the request; otherwise, it forwards it (step 1).

What happens to the request after the WAF forwards it?

After forwarding, the backend processes the request and generates a response (execution_table step 2), which is then sent back to the client (step 3).

Visual Quiz - 3 Questions

Look at the execution table, what is the WAF decision at step 1?

A Threat detected

B Request blocked

C No threat detected

D Response generated

💡 Hint

Check the 'WAF Decision' column for step 1 in the execution_table.

At which step does the WAF block the request?

A Step 3

B Step 4

C Step 2

D Step 1

💡 Hint

Look for 'Threat detected' and 'Request blocked' in the execution_table rows.

If the request content changes to a safe GET request, how does the WAF decision change?

A It forwards the request

B It blocks the request

C It alerts but forwards

D It ignores the request

💡 Hint

Refer to the WAF decision for normal HTTP GET in the execution_table step 1.

Concept Snapshot

WAF with Application Gateway inspects incoming web requests.
If a threat is detected, it blocks or alerts.
Safe requests are forwarded to backend servers.
This protects web apps from attacks like SQL injection.
WAF runs as part of the Application Gateway service.

Full Transcript

This visual execution shows how an Application Gateway with WAF works. When a client sends a web request, the Application Gateway receives it. The WAF inspects the request content for threats. If it finds a threat, like SQL injection, it blocks the request and sends a block message to the client. If no threat is found, the request is forwarded to the backend server. The backend processes the request and sends a response back through the gateway to the client. This protects web applications by filtering harmful requests before they reach the backend.