My application's code was written securely; is a WAF still necessary?

Short answer

Yes. Securely written code is an important layer, but an application does not consist only of its own code: vulnerabilities in the framework, libraries, application server and parsers are also carried into the application (why it is needed). The Signature & Rule Library of TR7 WAF contains signatures targeting third-party components, such as Log4Shell, Spring4Shell, Shellshock and ProxyShell/ProxyLogon; in Blocking mode and at the default Very Tight level, even a single hit from these signatures blocks the request, so in the time that passes until the patch is applied, the attack does not reach the Backend Service. The positive model, on the other hand, catches an input validation gap overlooked in the code as an unexpected parameter, length or method. WAF also meets the need for audit and compliance with attack records, reports and SIEM output (log and SIEM).

Situations Where the Code Alone Is Not Enough

Situation	The contribution of WAF
A new vulnerability in a library or server in use	Known exploit patterns are searched for with signatures; the signatures named Log4Shell, Spring4Shell, Shellshock and ProxyShell/ProxyLogon are 8 or 9 points. A single hit of 8 or 9 points is enough for blocking while the OWASP Protection Level is Aggressive, Very tight or Tight (threshold 2, 4, 8) (zero-day defense)
Overlooked input validation	Structural inspection counts an unexpected parameter, an out-of-bounds length or an unallowed method as a 24-point violation; this score reaches the threshold of every protection level (Can TR7 WAF catch a zero-day attack without a signature?)
Different platforms	Signatures are tagged according to the technology they target: Java, PHP, Node.js, .NET and Python runtimes, SQL and NoSQL databases, XML parsers, template engines, LLM services… (Protected Target Types)
Audit and evidence	Attacks are seen in Event Logs, and periodic summaries in WAF Report, with OWASP, CWE and MITRE mappings; attack details are sent to log targets with the SIEM & Attack Details setting

• How signature and structural inspection are reflected in the traffic depends on the mode: in Learning mode, no request is blocked because of these inspections, and in Monitor mode, the requests are only recorded; structural inspections do not run at all in Learning mode.
• At the Normal (threshold 16) and Elementary (threshold 24) levels, a single signature hit is not enough for blocking; if the scores accumulate or a structural violation is added, the request is blocked (How does TR7 WAF decide whether to block a request?).

Common Misconceptions

• "Attacks cannot reach an application that has passed code scanning." Code scanning covers only the application's own code; vulnerabilities that emerge later in dependencies are not visible in this scan.
• "WAF replaces secure code." WAF is an additional layer; it does not remove the requirement for the code to be written securely.

How it is done in the documentation

• WAF - WAAP · Why Is It Needed?
• WAF - WAAP · Zero-Day Defense
• Signature & Rule Library · Protected Target Types
• WAF - WAAP · Log and SIEM

Related questions

• Can TR7 WAF catch a zero-day attack without a signature?
• Which attacks does TR7 WAF protect against?
• What is a WAF and what does it do?