Browser & Web Performance · Senior · Question 71 of 75

What is the most important limitation of a Web Application Firewall (WAF) against XSS?

✓Correct answer: Payloads can be encoded or use new vectors that signatures miss, and DOM XSS may never reach the server
2A WAF blocks all JavaScript
3A WAF only works with HTTP/1.1

Explanation

A WAF is defense in depth. Context-aware encoding, sanitizers, CSP and Trusted Types are what actually fix XSS.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.