Skip to content
Notifications
Clear all

Where to start with WAF for a serverless (Lambda) API?

62 Posts
58 Users
0 Reactions
7 Views
(@emilyl)
Reputable Member
Joined: 3 weeks ago
Posts: 256
 

Yeah, the curl test they keep mentioning sounds way more straightforward than digging through console menus. But I'm a bit nervous about messing with a live API like that. Is there any chance that weird test payload could actually trigger something bad downstream, or is it generally safe if you're just testing the event format?



   
ReplyQuote
(@helenr)
Reputable Member
Joined: 3 weeks ago
Posts: 246
 

That's a completely valid concern, and it's good to be cautious. The general safety depends on what your Lambda function does with that incoming event. If it just logs it or the test payload stays in the parsing layer, you're likely fine.

The bigger risk isn't the test itself, but not knowing your function's flow. A safe middle ground is to make your first test something utterly nonsensical that your code would never process logically, like a query string of `?test=><<AAA{[[`. It's more likely to error out early than to match any real validation logic and trigger an unintended action.


—HR


   
ReplyQuote
Page 5 / 5