WAF Comparison — Test Application

This application is a controlled target for comparing Radware Cloud WAF and AWS WAF detection capabilities and performance overhead.

v1.0.0 2026-10-28T12:09:23.661546+00:00
Notice: This application is intentionally exposed to the internet as a WAF test surface. It contains no real data, no authentication, and no sensitive information. All data returned by its API is static mock content. Any apparent attack payloads sent to this host will be analysed by the WAF layer and are expected as part of the test programme.

Performance Benchmarking Endpoints

Products catalogue

GET /api/products
GET /api/products/<id>

Query params: category, sort, page, limit

Search

GET /api/search?q=<term>
POST /api/search

POST body: {"query": "…", "category": "…"}

Comments

GET /api/comments
POST /api/comments

POST body: {"author": "…", "body": "…"}

User profile

GET /api/users/<id>

URL path parameter — exercises path-segment inspection.

Payload-Size Benchmarking

Fixed-size responses

GET/api/payload/small~128 B
GET/api/payload/medium~4 KB
GET/api/payload/large~64 KB

Artificial latency

GET /api/delay?ms=<n>

Introduces a controlled server-side delay (max 2 s) to isolate WAF-added latency.

File upload

POST /api/upload

Multipart form upload (max 1 MB). Exercises WAF body inspection of binary content.

Health check

GET /health/

NLB target-group health check — always returns 200 {"status":"healthy"}.