# Troubleshoot blocked web traffic

Understand which public requests the WAF inspects and how to investigate a 403 or 413.

Canonical: https://docs.deliberate.space/operate/web-traffic/

Platform-generated public routes include an origin web application firewall
(WAF). It inspects incoming HTTPS requests before they reach your Component and
blocks requests whose combined signals resemble an application attack. You do
not need to install anything in your image.

> **The WAF is a safety net, not application security.** It can reduce exposure
> to common, recognizable attacks, but it cannot determine what is safe or
> authorized for your application. A request passing the WAF is not necessarily
> safe, and a route covered by the WAF is not necessarily secure.

You remain responsible for securing the application itself. This includes
authentication, authorization, tenant isolation, input validation, output
encoding, safe database access, secret handling, dependency and image patching,
rate limiting, abuse prevention, file validation, and application-specific
monitoring. Design and test those controls as though the WAF were not present.

## Requests the WAF blocks

The gateway runs Coraza with the OWASP Core Rule Set at paranoia level 1. The
rules cover common web attacks and protocol anomalies, including:

- SQL injection and cross-site scripting patterns;
- command injection and path traversal;
- server-side request forgery patterns;
- malformed or evasive HTTP requests; and
- common scanner and automated attack signatures.

Rules contribute to an anomaly score. deliberate. uses an inbound blocking
threshold of 15 rather than the stricter CRS default. This keeps the baseline
protection active while reducing false positives from ordinary JSON, quoted
values, file uploads, and framework-generated requests. Two broad protocol
rules that reject modern content types and proxy headers are disabled globally.

## Check whether your route is covered

| Traffic path | Current behavior |
| --- | --- |
| Platform-generated public HTTPS route | Request passes through the WAF |
| Plain HTTP | Redirected to HTTPS before reaching the application |
| Private Net route | WAF bypassed after device authentication and route authorization |
| Customer-owned custom domain | Not currently covered by the tenant WAF filter |
| TCP or UDP exposure | Not HTTP and therefore not inspected by the WAF |

The Private Net bypass is intentional. A private route is already restricted to
authenticated devices belonging to explicitly allowed Team members, and admin
tools commonly send SQL or other technical input that resembles an attack to a
generic HTTP rule set. Private Net controls who can reach the route; it does not
replace authentication or authorization inside the application.

Custom-domain coverage is a current platform limitation. Do not assume that
attaching a custom hostname adds WAF inspection until this page states that the
custom-domain listener is covered.

## Identify a gateway response

A request that reaches the anomaly threshold is stopped at the gateway and
normally receives **HTTP 403**. Your component never receives that request, so
its application logs may contain no corresponding entry.

The WAF inspects request headers, paths, query strings, and request bodies. A
request that exceeds the WAF's body-processing limit can receive **HTTP 413**.
This matters for applications accepting large uploads: test the real upload
path before relying on the platform-generated public route for large objects.

Response-body inspection is disabled. Responses are still carried over TLS,
but the WAF does not scan or rewrite content produced by your application.

## Report a false positive

First confirm whether the response came from the gateway rather than the
application:

1. Record the hostname, path, HTTP method, response status, and UTC timestamp.
2. Capture the response's request ID or correlation header when present.
3. Check whether the request is absent from the component's application logs.
4. Reduce any sensitive request body to the smallest reproducible shape before
   sharing it with support.

There is currently no customer-authored WAF exclusion field. Contact deliberate.
with the details above when legitimate traffic is blocked. A broad bypass is
not applied silently: an exclusion must be narrow enough to preserve protection
for unrelated routes and customers.

## Coverage limits

The origin WAF is a best-effort additional filter for common HTTP attack
patterns. It does not provide or replace:

- application authentication, authorization, or tenant isolation;
- application-aware validation and output encoding;
- API quotas, rate limiting, or abuse prevention;
- malware scanning of uploaded files;
- dependency patching or image vulnerability remediation;
- protection against every novel or application-specific attack; or
- a global content-delivery or volumetric DDoS service.

Use Private Net for administrative interfaces that should not be public. For
public applications, treat the WAF only as an additional safety net in front of
the security controls implemented by the application itself. Never use WAF
coverage as the reason to omit or weaken an application security control.

## Next steps

- [Review the complete security boundary](/security/)
- [Restrict an administrative route with Private Net](/private-net/connect/)
- [Troubleshoot the application deployment](/operate/observe-and-recover/)