A request arrives at your server for /api/vehicles/1' OR '1'='1 . Before a single line of your application code runs, something in front of it reads that string, recognises the shape of a SQL injection attempt, and answers 403. That something is a web application firewall, and last month I spent a weekend trying to work out whether mine was actually earning its place. First, what the thing actually is It is software. Twenty years ago you might have racked a physical appliance...