LinkedIn Tag

Can a WAF protect against supply chain attacks on third-party JavaScript libraries?

WAFs cannot protect against client-side supply chain attacks because they don't intercept the fetch to the 3rd party endpoint and therefore have no visibility into the JavaScript files from the 3rd party sources. Even in the event of an attack on popular libraries or CDNs, the malicious payloads continue to be delivered from the same trusted sources that your WAF has whitelisted. Your WAF still sees these compromised sources as legitimate requests and allows them through, not knowing that the contents have been weaponized by bad actors.

Questions left?
Get answers from our experts