How to Protect Your REST API with a Free WAF

#security #webdev #api #devops

Why APIs Need Different Protection

Web form attacks (SQLi, XSS) target HTML endpoints. API attacks are different — they exploit JSON bodies, GraphQL queries, auth tokens, and rate limits. Your API needs protection that understands these attack vectors.

API-Specific Threats

Threat	What It Looks Like	Without WAF
GraphQL deep queries	`{users{posts{comments{author{email}}}}}`	Server CPU exhaustion
BOLA (Broken Object Level Auth)	`GET /api/users/12345` when you own user 67890	Data leak
Mass assignment	`{"role":"admin"}` in a user update payload	Privilege escalation
JWT replay / none algorithm	Manipulated tokens without server-side validation	Auth bypass
API rate abuse	10,000 req/min to `/api/search`	Server crash

Setting Up SafeLine for API Protection

# 1. Deploy SafeLine behind your API gateway
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

# 2. Add your API domain as a site
# Domain: api.yourdomain.com
# Backend: localhost:3000 (your API server)

# 3. Create custom rules for API protection
# Rule 1: Block requests without proper Content-Type for POST/PUT
# Rule 2: Limit request body size (prevent large payload attacks)
# Rule 3: Rate limit per API key (not just per IP)

Rate Limiting for API Endpoints

The most effective API protection you can set up in 5 minutes:

Endpoint: /api/*
Limit: 100 requests/minute per IP
Action: Block with 429 status

Endpoint: /api/auth/*
Limit: 10 requests/minute per IP
Action: Block with 429 + captcha challenge

Endpoint: /api/search
Limit: 30 requests/minute per IP
Action: Throttle

SafeLine's semantic engine also catches injection attempts in JSON bodies, GraphQL queries, and URL parameters — the same 71.65% detection rate applies to API traffic.

What SafeLine Detects in API Traffic

SQL injection in JSON body fields
NoSQL injection targeting MongoDB endpoints
Command injection in query parameters
SSRF via URL parameters that resolve to internal IPs
Path traversal in file upload endpoints
XML External Entity (XXE) attacks

FAQ

Does the WAF add latency to API calls?

About 1ms per request (measured on a 2GB VPS). For an API that already takes 50-200ms to process a request, this is negligible. The security gain far outweighs the 1ms cost.

Can I whitelist certain API endpoints?

Yes. Create a whitelist rule for health check endpoints (/health, /ping) or webhook receivers that need to accept large payloads. Everything else gets full inspection.

What about authenticated vs unauthenticated API routes?

Create separate rate limit rules for authenticated (higher limits) vs unauthenticated (lower limits) endpoints. SafeLine can distinguish them by the presence of Authorization headers.

Try SafeLine Community Edition — free, self-hosted, and takes 5 minutes to deploy:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

Dashboard: https://<your-server-ip>:9443 | Docs

What API endpoints are you exposing right now without WAF protection?

Top comments (6)

Luis Cruz • Aug 7

I found the section on API-Specific Threats to be particularly enlightening, especially the example of GraphQL deep queries, which can lead to server CPU exhaustion if not properly handled. The provided example, {users{posts{comments{author{email}}}}}, highlights the importance of understanding these attack vectors. In my experience, implementing rate limiting and custom rules, as shown in the Setting Up SafeLine for API Protection section, can be an effective way to mitigate such threats. I'm curious, have you considered implementing additional measures such as IP blocking or behavioral analysis to further enhance API protection?

Lia • Aug 7

Sure! These are also very important, and SafeLine supports them as well.

Luis Cruz • Aug 11

Thanks, Lia. That’s good to know. I especially like the self-hosted approach with SafeLine — it fits well with systems where keeping infrastructure and security controls under your own management is important.

I work mainly on backend/AI systems and automation, and security becomes increasingly important when those systems expose APIs, webhooks, tool endpoints, or agent workflows. I’ve been interested in combining API security with practical observability and automated detection rather than treating the WAF as the only security layer.

Your work around WAFs, API protection, and self-hosted infrastructure overlaps nicely with what I’m building on the backend/AI side. Would be great to connect and exchange ideas. If you’re ever working on a security/API project where an additional engineer could help, I’d also be open to collaborating on a paid project or longer-term opportunity.

Always happy to learn from someone working deeply in the security side.