Skip to content
Docs

Settings — WAF Protection

Navigate to: Settings → WAF Protection

The built-in Web Application Firewall inspects all gateway requests for injection attacks, prompt manipulation, and other OWASP patterns.

Cross-reference: Full documentation at section 7.5.

Quick steps:

  1. Navigate to Settings → WAF Protection.
  2. Toggle WAF Enabled on.
  3. Set Mode: Detect (log violations, pass requests) or Block (reject violating requests with 403).
  4. Review Built-in Rules — all are enabled by default.
  5. Add a Whitelist Path if a specific route should bypass WAF (e.g., /v1/embeddings).
  6. Click Save.

How to test:

  1. Enable WAF in Block mode.
  2. Send a request containing a SQL injection pattern: '; DROP TABLE users; --
  3. The request should return 403 Forbidden with a WAF violation response.
  4. Check the Violations tab — the blocked request should appear.