Anyone use Cloudflare WAF ?

[juice]

Particularly for protecting an in-house mobile app/API ?

[CharlieCrocodile]

Not for a home site, but we do use it for a global booking system. What do you need?

[eeLee]

I've been indirectly involved in speccing a service out for annual results webcast to protect against DDoS. It worked, we got metrics on the number of threat actors who tried to impact it and it stayed up. The service was surprisingly cheap for what it was and was being VARed through our ISP.

[somouk]

Use the Akamai WAF, not cloudflare, much better.

• I may be biased.

[juice]

Sorry for not responding.

We're currently building a mobile trading app that bolts onto our existing (in-house) Trading system with the normal stuff like Global Equities, FX, Funds, Bond Trading, FiX connections to counterparties and routing to Bloomberg EMSX. We're also soon to be launched on-boarding app that lets clients sign-up and then eventually securely upload their KYC documentation.

We're looking to protect these apps and our API from the normal threats and use the CDN capabilities to maximize uptime

So normal stuff like
DDOS
OWASP vulns
Botnets etc

I understand Cloudflare are reasonably priced vs other competitors, I was just interested in people's experiences with the service.

I think Akamai might be out of our price range unfortunately.

We could utilise our Fortigate infrastructure and purchase FortiWeb, but that means purchasing at least 2 appliances for the Primary and DR sites.

Edited by juice on Saturday 16th July 09:48

[bitchstewie]

We use Cloudflare.

I'm not a developer and I'm not a security specialist but as a "10 minute WAF" it seems to do a good job and "just works".

[CharlieCrocodile]

Cloudflare will help you with your requirements certainly. It also hosts our DNS which makes life a lot easier too.

Make sure that you lock down the apps to be accessible only from cloudflare data centers otherwise you'll negate the benefits.

Caching works really well too, I think it served/cached about 2tb of data last month whilst Azure only transferred out 300gb.

Edited by CharlieCrocodile on Saturday 16th July 18:34

[e-honda]

I used cloudflare for an API, for us it was purely down to cost, they were pricing us on bandwidth and since the majority of our traffic was API our bandwidth relative to our number of requests was extremely low, we were using google cloud and our bandwidth discount with them for using cloudflare was more than our cloudflate subscription. Now working with AWS and cloudflare are not pricing anywhere near as competitively for me.
This was a web API and the WAF rules were reasonable for our purposes although not brilliant, rate limiting was excluded and would have massively increased our costs.
I'm not convinced it would be particularly great for mobile app API although it has been 3 years since i last used it I know they have expanded its capabilities.
Most of the cloud providers have API gateways that would not necessarily need waf and would probably be more appropriate unless you have a hard requirement to have waf.

[Alex Z]

We’ve used it for about 4 years now and are very happy with the service. The Business tier is great value.
Only one outage caused by them in that time and they fixed it very quickly.

[bitchstewie]

As above the business tier is amazing value and make sure you lock down your firewall to only allow Cloudflare IP addresses to hit your sites.

It won't work miracles if you've written a bad application that can be exploited but it will do a lot to soak up and "bad" traffic and deal with attempts to exploit common vulnerabilities and bots etc.

[somouk]

Joking aside, the cloudflare WAF will do a good job.

Good tip above about locking down your web server to only allow access via the cloudflare addresses.

[e-honda]

Unless it is a progressive web app then an mobile app API is not allowed on the self service tiers.
If your requests are low enough you probably won't get flagged up, but it would probably be far better an no more expensive to use an API gateway.