# WAF and gateway at the front

> Put a WAF and an API Gateway in front of the App Servers, so bots and bursts are stopped before they cost you capacity.

Filter traffic at the edge: a WAF drops bots, and a Gateway caps what is left.

## Move up when

- Bots take a large share of requests and load the App Servers.
- Logins spike from bots, or a burst from one client crowds out the rest.
- You want one place to see and cap API traffic.

## The Design



Users hit the WAF first, then the API Gateway, then the App Server and the Database. The WAF's **Paranoia level** sets how aggressive it is. The Gateway's **Rate limit** caps requests a second.

## Why it works

The WAF blocks a share of bots, so the App Server never spends CPU on them. A higher paranoia level blocks more bots, costs more CPU per request, and blocks more real users too, which is where the caption's errors come from. The Gateway's limit sits a little above the peak you want to serve. Requests past it fail as `throttled` at the edge and never reach the servers. Each layer protects the one behind it.

## What it costs

Both layers add a hop to every request. A paranoia level that is too high blocks shoppers, which costs more than the bots did. A rate limit caps volume and cannot tell a bot from a shopper, so it does not replace the WAF. The Gateway bills per request, so it is cheap at low volume and a real line on the bill at high volume. Under attack mode blocks nearly all junk and some real users, so use it only while an attack lasts.

## In Quorum

Place a [WAF](https://wiki.playquorum.dev/components/waf.md) after [Web application firewall](https://wiki.playquorum.dev/research/waf.md), and an [API Gateway](https://wiki.playquorum.dev/components/gw.md) after [API gateway](https://wiki.playquorum.dev/research/api-gateway.md). [Rate limiting](https://wiki.playquorum.dev/research/rate-limiting.md) adds a token bucket for bursts, and [Bot management](https://wiki.playquorum.dev/research/bot-management.md) challenges a client instead of blocking it. See [WAF and bot management](https://wiki.playquorum.dev/patterns/waf-and-bot-management.md) and [API gateway patterns](https://wiki.playquorum.dev/patterns/api-gateway-patterns.md). The next rung is [Auth and TLS at the gateway](https://wiki.playquorum.dev/patterns/auth-and-tls-at-the-gateway.md).

Source: https://wiki.playquorum.dev/patterns/waf-and-gateway-at-the-front