Using WAF with a Vaadin application on the latest major version

Flow
1

We are happily using the latest major version of your Vaadin framework in a complex enterprise application of ours. The application is running in a containerized setup in AKS and on suggestion of our dev-ops an security teams we also taking use WAF (Web Application Firewall) within our infrastructure. This infra level security layer has been causing us many problems lately, as we are getting significant amounts of false positives, which basically fry our application from the user’s perspective.

What happens is the users writes something in an input field which the WAF interprets as potentially malicious code. This is far from true, if you take a look at the input as a human, however since the WAF operates with REGEXP tools, it does not make such distinctions. This then leads to the answer being blocked and us sending back 403 as an answer to Vaadin instead of a 200, Vaadin retries many times, then after the retrial limit just kills the thread, from which all the users sees is a built in Vaadin banner connection lost.

We are writing to ask about 2 things:

  1. Are there best practices on how to best use Vaadin applications together with WAF in your infrastructure? If so can you please point to these?

  2. Are there resources or better yet a short listing from vaadin officially on what security checks and measures are already built in to the Vaading Framework by default specifically on input sanitation? We are leaning to disable certain WAF rulesets that we always see problems with, as we think vaadin must already have application side security on this, such as injections on the platform level (like Linux commands, mySQL or MSSQL query injections etc.) but we don’t have any official documentation for that.

Thanks in advance.

2

Values that are used internally by the framework, e.g. identifiers used as part of the communication protocol, are carefully filtered and validated but values that “belong to” the application are passed through as-is without any filtering at all.

Different filtering rules would be needed for different usages and the framework can’t know how the application will use the received values. Any WAF has exactly the same problem of not knowing how a value will be used which means that it has to be overly paranoid about everything. If you want WAF-like functionality, then use a WAF since that kind of product can specialize in giving the user control over what’s filtered and not.

3

Our documentation is not directly refer to WAFs, but when you follow this advice, the general principle is that you should not use too eager WAF ruleset and instead sanitize or block input in your application logic. As you noticed, if WAF blocks a packet, that will render Vaadin to inconsistent state, and it attempts to recover from it, but the recover process itself can be blocked by WAF too in some scenarios. This part of the Vaadin’s stateful nature.