Web app and API protection (WAAP) describes a cybersecurity approach focused on protecting modern apps and APIs from evolving threats. This category of security arose from the recognition that these software components face unique challenges, underscored by the growing popularity of microservices architectures reliant on decoupled APIs. The term "cloud WAAP" has also emerged to capture the proliferation of hosted SaaS solutions, which help protect apps and APIs running either on premises or in the cloud. 

As a result, WAAP centers on protecting servers, databases, and critical integrations against attackers. The concept also recognizes that the development tools and technologies we've come to rely on (coding languages included) have opened the door for more vulnerabilities—just like they have for innovation. This is especially important in a world where API design standardization is ever-changing alongside development best practices. Throw in the fact that public and private APIs collectively handle mountains of sensitive data, and it's unsurprising that these software components are regularly targeted. 

This double-edged sword has prompted new WAAP vendors to emerge, while other companies (such as those that build load balancers) have expanded their solutions to better encompass web app and API protection. It's each organization's responsibility to either build their own solution or outsource WAAP to minimize management overhead.

Web app and API protection (WAAP) by the numbers

Security threats have grown alongside API adoption, but here are some interesting facts and figures highlighting WAAP's importance across all industries: 

  • 61% of API attacks come from unauthenticated attackers, per a Salt Security survey.

  • 95% of those survey respondents have had trouble mitigating API security incidents.

  • While 80% of attacks leverage an OWASP Top 10 attack method, just 58% of surveyed organizations employ targeted protections.

  • Over 50% of organizations have delayed an API release over security concerns. 

  • Only 11% of Salt-surveyed companies have any API security plan, including testing and protection. 

It's clear that companies need to strengthen and/or implement strong security measures to keep pace with attackers. This is a problem impacting all industries, yet it threatens to cause profound harm in sensitive industries (banking, government, healthcare, utilities).

Which threats can WAAP help counteract?

The variety of threats against web applications and APIs is always expanding. However, here are some of the most common attack vectors observed today: 

  • Denial of Service (DoS) – Blocks access to services by flooding them with illegitimate requests, shutting out real users

  • Overuse and abuse – Overuse of an API by one or more clients consumes excessive backend resources, hampers performance, and can even cause outages during traffic spikes. Meanwhile, abuse also encompasses improper access to API functions with hopes of obtaining restricted data. 

  • Cross-site scripting (XSS) – Attackers inject malicious code into web applications, enabling tracking, data theft, and harmful remote code execution. 

  • Cross-site request forgery (XSRF) – Bad actors execute commands externally by compromising authenticated user accounts. 

  • Automated bots – Unauthorized crawlers, scrapers, and more can impersonate real users or even circumvent restrictions in robots.txt to perform certain actions. These can be malicious, undermine privacy, and cause performance issues at scale. 

This list is far from exhaustive. It also fails to capture new threats that could emerge at any time, including zero-day vulnerabilities.

How does web app and API protection (WAAP) work?

There are many facets to WAAP that help form a well-rounded defense against modern cyber threats. These include a combination of the following: 

Web app and API protection rely on these mechanisms and other measures to be effective. And in the spirit of DevSecOps, WAAP strategies require analysis into your organization's unique threat profile. What works for one doesn't work for all, making customization (and observability) a critical factor when choosing an ideal WAAP solution.

Does HAProxy provide web app and API protection (WAAP)?

Yes! HAProxy Enterprise includes numerous security measures to protect web applications and APIs against today's and tomorrow's threats. The HAProxy Enterprise WAF, HAProxy Enterprise Bot Management Module, and Global Rate Limiting features stand tall against some of the web's most common threats, while also boosting performance, observability, and reliability. 

To learn more, check out our HAProxy Enterprise 2.9 announcement to dive into these core features or visit our security solution page.