Web Application Firewall

Overview

Material uses a Web Application Firewall (WAF) to protect your instance. The WAF provides two key capabilities:

• Block malicious traffic before it reaches the Material API, using the proven Open Web Application Security Project (OWASP) Common Rule Set (CRS).
• Rate-limit excessive traffic to prevent it from overwhelming the Material API, which could result in a denial-of-service (DoS).

Material uses Google Cloud Armor for our WAF, with individual rules that have been tuned to the Material API.

Blocking Malicious Traffic

Any traffic that the WAF deems to be malicious will be blocked with an HTTP 403 “Forbidden” response. If you experience this, either in the Material console or using the Material API, please reach out to our Support team.

Rate-limiting Excessive Traffic

Any traffic that exceeds the rate limit will be blocked with an HTTP 429 “Too Many Requests” response. If you experience this, either in the Material console or using the Material API, please reach out to our Support team.

Rate-limiting occurs when a specific client (identified by IP address) exceeds the allowed number of requests in a given time interval. Traffic is divided into two buckets:

1. Unknown routes: any route that does not match a valid Material API base path (example: /phpmyadmin/index.php). These are rate-limited more aggressively.
2. Known routes: any route that matches a valid Material API base path (example: /api/...). These are allowed a higher limit.