Public traffic to Apivom does not reach our application directly. It first passes through Azure Front Door Premium, Microsoft's global edge network, with a Web Application Firewall (WAF) attached.
A WAF inspects every incoming HTTP request at the network edge, before it reaches the application. That matters because it stops a large class of attacks — injection attempts, malformed requests, known attack signatures — close to the source, rather than inside our own infrastructure.
Our WAF policy runs in Prevention mode, backed by Microsoft's managed rule sets, plus:
- The HTTP DDoS ruleset, which learns a traffic baseline over a rolling window and automatically throttles anomalous spikes — from a single client, a botnet, or a geographic region — without us having to pre-configure fixed thresholds.
- Bot Manager, a managed rule set that identifies and acts on traffic Microsoft's threat intelligence classifies as automated abuse.
- Rate limiting, to cap how often any single client can call our service.
- Custom rules, so we can respond to a new attack pattern within minutes, platform-wide, without a code deployment.
Azure Front Door is deployed across Azure's global network edge locations. That gives us a geographically distributed first line of defense: an attack is absorbed and filtered close to where it originates, not after it has already reached a single data center.
What this does not mean
A WAF reduces exposure to common, known attack patterns. It does not replace secure application code, authentication, or authorization — those controls still have to be correct on our side. We treat the WAF as one layer in a stack, alongside enforced two-factor authentication and automated dependency scanning, not as a substitute for them.