Everyone's pushing GraphQL now. Great. Now try putting a WAF in front of it without turning every mutation into a 403. The usual signature-based boxes see a giant POST to `/graphql` and panic.
I've seen teams try to dump the entire JSON payload into a single WAF field for inspection. It's a mess. The parsing depth alone kills performance.
What's actually working? I need something that can:
* Understand the GraphQL AST at the edge.
* Apply rules to specific fields, not just the raw HTTP blob.
* Not choke on nested queries or batched requests.
The "modern" vendors all claim they do this. Most just do regex on the body. Show me the config or the actual logic. Something that isn't just a glorified rate limiter.
Example of the noise a simple WAF rule catches on a normal `/graphql` endpoint:
```json
{
"operationName": "UpdateUser",
"query": "mutation UpdateUser($input: UserInput!) { updateUser(input: $input) { id name } }",
"variables": {
"input": {
"id": "1",
"name": "Robert'); DROP TABLE users;--"
}
}
}
```
A dumb rule blocks on `DROP TABLE`. A smart one knows that string is inside the `variables` for the `name` field, not the query itself. Which ones actually get this right?
If it ain't broke, don't 'upgrade' it.