Firewall
Block requests before they reach your app.
A Firewall policy blocks every request that matches its conditions. The client gets 403 Forbidden with the error firewall_denied, and your app never sees the request. Policies after it aren't evaluated.
Examples
Keep an admin area private. Block /admin for everyone outside your office network:
- Path, prefix
/admin - Remote IP, not in
203.0.113.0/24
Block a crawler. Match the header User-Agent with the regex (?i)badbot.
Close a debug endpoint in production. Match the path /debug exactly, and apply the policy to production only.
What a firewall isn't
The firewall decides about single requests. It doesn't count requests and isn't protection against floods of traffic.