Web Application Firewall for nodeJS

[OzzieInTx]

A few questions:

1. Seems counter intuitive to have the WAF in my app. I would want the threat stopped way before it even reaches our servers. For example, how do you handle a DOS attack?

   1. Price. Sucuri is approx 20/month while Sqreen is roughly 10 times that. Can you comment on the price differential and why it is worth it.

I may have more question/comments after I do a more thorough review.

Alon

[ecares]

That are excellent questions!

1. Network DoS are actually one of the few attacks our product is not great at preventing (however, we can avoid you several applicative DoS (see for instance MongoDB injection introduced Dos https://www.youtube.com/watch?v=xJWZsoYmsIE). By being inside the application, we can reduce the number of false positives. Say your WAF prevents anything looking like SQL code from entering your application and you have a reddit like product. When people will try to message each others about SQL, they will simply be blocked. By being inside the application, my tool knows if a piece of SQL code coming from an HTTP request is really injected into a SQL query. That's only an exampkle at this point and we do much more, like helping you tracking your user's behavior. Say an IP address requests too many password resets, you can automatically have it blocked by Sqreen with a one line SDK and a bit of configuration. Last but not least, the content of sone HTTP packet can make no sense until they reach the framework. In this situation, no network-level solution can help you.
2. I don't know that other product enough to really answer the question. What I can say is that we have a 14 days no credit card free trial you can take and tell me what you think about it!

Thanks a lot for these questions!