Security at the Edge: WAF, DDoS Protection, Rate Limiting, Bot Management and Locking Down the Origin
The WAF, DDoS protection, rate limits and bot rules at the edge only see traffic that goes through the edge; if the origin's IP leaks they are all bypassed, so the origin must accept connections only from the CDN. On an Nginx edge we see a login rate limit stop an attack before it reaches the origin, how forwarded header order in the ASP.NET Core rate limiter protects customers, and why an IP allowlist must be completed with Authenticated Origin Pulls, a tunnel or X-Azure-FDID.
14 Nov 2026
·
14 min
·
2
