Web Application Firewall

Rules: SQL injection (ON), XSS (ON), command injection (ON), path traversal (ON), custom rules, whitelist paths. AI-specific abuse patterns: token stuffing (single-request token-count budget enforced before forwarding), prompt flooding (burst-rate ceiling per source), abnormal-session blocking (anomalous session-duration / call-shape detection), header bombs (max-header-size enforced upstream of the LLM proxy), oversized payloads (50 MB request body cap). Modes: detect (log) or block (reject). DDoS: rate limiting + IP allowlisting (CIDR) + circuit breakers form a defense-in-depth chain — production deployments front this with HAProxy or a cloud WAF (CloudFront/AWS WAF, Cloudflare, Azure Front Door) for L3/L4 absorption. APIs: config, violations, stats.

---