When a domain is connected to CDN for content acceleration, origin servers are exposed to web attacks such as SQL injection and XSS. This best practice guides you through deploying WAF on the CDN origin-return path to filter malicious traffic while preserving CDN acceleration.
Scope
Applicable architecture: This document applies to the dynamic-static mixed architecture with CDN and ECS, ensuring that static content continues to be accelerated by CDN while WAF focuses on protecting dynamic resources. For CDN+OSS pure static hosting architectures, WAF protection is limited since OSS only stores static files without application-layer attack risks. In this case, adding WAF would increase the origin request chain and access latency, so it is not recommended.
Prerequisites: The target domain must be connected to Alibaba Cloud CDN, DCDN, or another CDN provider.
Notes: This document uses Alibaba Cloud CDN as an example. The same logic applies to DCDN or CDN services from other providers.
Business impact: Perform these operations during off-peak hours to minimize impact on services.
Select a connection method
WAF supports collaborative deployment with other cloud products to build a defense-in-depth architecture. In an architecture without WAF, user requests are resolved through DNS to CDN nodes and then directly routed to the origin server. This means both attack traffic and legitimate traffic reach the origin server unfiltered.
WAF provides two connection methods: CNAME access and cloud product access. Compare the options below and select the method that best fits the architecture.
Feature | Cloud Product Access | CNAME Access |
Advantages | No need to modify the CDN origin configuration. Minimal impact on services. Suitable for quick connection scenarios. | Broad applicability. Fewer functional limitations. Supports cross-account and cross-cloud deployments. |
Connection Target | Alibaba Cloud product instances. | Domain name. |
Limitations |
| Slightly complex configuration. Requires configuring CDN origin settings and obtaining the real client IP. |
For more information about the comparison and principles of connection methods, see Overview.
Procedure
Activate WAF (required only if WAF is not activated): If WAF is not activated, visit Web Application Firewall 3.0 (Pay-as-you-go) purchase page. For first-time use, we recommend Payment Method as Pay-as-you-go. For the purchase process, see Activate a pay-as-you-go WAF 3.0 instance.
Navigate to the WAF console: Log on to the Web Application Firewall console. In the top navigation bar, select the resource group and region of the WAF instance (Chinese Mainland, Outside Chinese Mainland). In the left-side navigation pane, click Onboarding.
Connect assets: Select one of the following methods to connect assets for protection: CNAME access or cloud product access.
NoteThe following operations require referencing the existing CDN configurations. To ensure accuracy, go to the CDN console to confirm the domain name, origin, and related configurations before proceeding.
CNAME Access
On the CNAME Record tab, click Add. On the Configure Listener page, configure the following parameters.
Parameter
Description
Domain Name
Enter the domain name that is already connected to CDN. Only one domain name to be protected can be entered. Both exact domain names (for example,
www.aliyundoc.com) and wildcard domain names (for example,*.aliyundoc.com) are supported.Protocol Type and Port
Select based on the origin protocol and port already configured in CDN:
Protocol: Must be consistent with the CDN origin protocol.
Port: Must be consistent with the CDN origin port.
By default, when the CDN origin port is set to 443, HTTPS is used for origin requests. For all other ports, HTTP is used.
If HTTPS is used, upload a certificate file that matches the domain name. If the certificate has been uploaded to the Certificate Management Service of the account, the existing certificate can be selected directly.
Is a Layer 7 proxy such as Anti-DDoS Proxy or CDN deployed in front of WAF
Because traffic is routed through the CDN, select Yes here. If misconfigured, WAF cannot obtain the real client IP, and reports will show all requests as coming from CDN nodes.
Set Obtain Actual IP Address of Client to [Recommended] Use the First IP Address in Specified Header Field as Actual IP Address of Client to Prevent X-Forwarded-For Forgery.
Set Header Field to
ali-cdn-real-ip. This is the HTTP request header that Alibaba Cloud CDN carries by default in origin requests to store the real client IP.
NoteThe field used by Alibaba Cloud CDN origin requests to store the real client IP is
ali-cdn-real-ip.When using a CDN product from another provider, refer to its official documentation to confirm the corresponding field name. Alternatively, CDN can also be configured to add custom outbound request headers and use a custom origin request field.
Click Next to go to the Configure Forwarding Rule page. Enter the Origin Address and click Submit.
The origin address must be the same as the one configured in the CDN console.
On the Add Completed page, click Copy CNAME.
Go to the CDN console. Click Domain Names, locate the domain connected to WAF, and click Actions in the Manage column. In the Origin Information section, click Actions in the Modify column. Change Origin Info to the CNAME address copied in the previous step. This operation points the CDN origin path to WAF.
ImportantIn the following scenarios, additional configurations are required:
CDN origin HOST configuration: If the default origin HOST is configured, update it to point the CDN origin path to WAF.
Bypass WAF for static files: To reduce performance overhead for static file requests that bypass WAF, configure conditional origin for CDN or add the related resources to the WAF whitelist.
Origin server records the real client IP: To have the origin server (for example, the access.log of NGINX) record the real client IP, configure the origin server to extract the real IP field. For more information, see Obtain the Real IP Address of a Client.
Advanced features of CNAME access: The CNAME access method of WAF supports advanced features such as HTTPS, IPv6, origin load balancing, and high availability. To customize these configurations, see Add a domain to WAF via CNAME.
Cloud Product Access
On the Cloud Native tab, select the type of cloud product to connect. Taking an ECS instance as an example, click Elastic Compute Service (ECS), locate the target instance, and click Add Now in its Actions column.
NoteWhen connecting other cloud products, refer to the following configuration items and complete the setup based on the corresponding Cloud native mode documentation.
In the Add Now dialog box that appears, click Add Port in the Actions column. Select based on the origin protocol and port already configured in CDN:
Protocol: Must be consistent with the CDN origin protocol.
Port: Must be consistent with the CDN origin port.
By default, when the CDN origin port is set to 443, HTTPS is used for origin requests. For all other ports, HTTP is used.
If HTTPS is used, upload a certificate file that matches the domain name. If the certificate has been uploaded to the Certificate Management Service of the account, the existing certificate can be selected directly. After configuration, click OK.
Return to the Add Now page. Because traffic is routed through the CDN, select Yes in the Is a Layer 7 proxy such as Anti-DDoS Proxy or CDN deployed in front of WAF section. If misconfigured, WAF cannot obtain the real client IP, and reports will show all requests as coming from CDN nodes.
Set Obtain Actual IP Address of Client to [Recommended] Use the First IP Address in Specified Header Field as Actual IP Address of Client to Prevent X-Forwarded-For Forgery.
Set Header Field to
ali-cdn-real-ip. This is the HTTP request header that Alibaba Cloud CDN carries by default in origin requests to store the real client IP.
NoteThe field used by Alibaba Cloud CDN origin requests to store the real client IP is
ali-cdn-real-ip.When using a CDN product from another provider, refer to its official documentation to confirm the corresponding field name. Alternatively, CDN can also be configured to add custom outbound request headers and use a custom origin request field.
Click OK to complete the connection.
NoteTo reduce performance overhead for static file requests that bypass WAF, also configure conditional origin for CDN or add the related resources to the WAF whitelist.
Verification testing: Enter the domain name of the protected website in a browser to test whether the CDN and WAF connection is successful.
Append web attack code after the domain name (for example,
<protected-domain>/alert(xss), wherealert(xss)is a cross-site scripting attack code used for testing). If a 405 block page is returned, the attack is intercepted and WAF protection is successful.Press F12 to open the browser developer tools. After refreshing the page, switch to the Network tab. Click the target static resource. On the Headers tab, locate the X-Cache field. If the value is hit instead of miss, the cache is hit and CDN acceleration is in effect.
Configure custom WAF protection rules: WAF enables a set of default protection rules for the connected object, which is suitable for daily protection scenarios. View them on the page. When the default rules do not meet requirements (for example, whitelisting requests with specific characteristics), create or modify protection rules. For more information, see Protection configuration overview.
FAQ
What should I do if the WAF console displays "The issue of unknown DNS resolution occurs.A proxy is deployed." after CNAME access?
When using the CNAME access method, this prompt in the console is normal. This occurs because the DNS resolution of the domain name directly points to CDN, so WAF cannot directly obtain the resolution status. This prompt can be ignored.
To confirm whether the connection is successful, follow the verification testing steps described earlier.
Do I need to refresh the CDN cache after connecting WAF?
In most cases, refreshing the CDN cache is not required.
However, under specific configuration changes, a manual refresh operation is required. See the following details:
No refresh required
If only the WAF connection configuration was completed without changes to the origin server content, no refresh is required. Because the static resources on the origin server have not changed, the existing cache on CDN nodes remains valid.
Refresh required
If any of the following conditions are met, manually refresh the CDN cache to ensure the configuration takes effect:
Static resource files on the origin server were modified.
HTTP response headers related to cache policies were adjusted.
The Bot Management feature of WAF was enabled and automatic connection of the web SDK was configured.
What should I do if the website prompts "too many redirects" after connection?
This is usually because the origin server is configured with an HTTP-to-HTTPS forced redirect rule, which creates a redirect loop between WAF/CDN and the origin server.
Configure the origin protocol as HTTPS on the device immediately before the origin server. The specific configuration location depends on the connection method used:
CNAME access: The previous hop device is WAF.
Cloud product access: The previous hop device is CDN.
For more information, see Too many redirects after CDN acceleration.
What are the differences between the WAF protection feature provided in the ESA console and the WAF described in this document?
ESA is the next-generation upgrade of CDN. It not only fully covers all the acceleration capabilities of CDN but also deeply integrates more powerful security protection and edge computing features.
Regarding the WAF differences:
Billing difference: The WAF protection feature of ESA is deeply integrated. The costs are included under ESA billing. The WAF described in this document is an independent cloud product that requires separate activation and is billed according to its own Billing methods.
Feature difference: The built-in WAF feature of ESA is primarily adapted for edge security acceleration scenarios and meets common website protection needs. The WAF product described in this document is more comprehensive. It not only covers all capabilities of ESA WAF but also provides protection rules that cover a full range of business scenarios.