Posting here to get advice on self-hosted instance, if someone uses Akamai WAF that blocks any code snippet from posting in a topic? For example, in composer following code is identified as malicious or XSS code. /home/abyss/anaconda3/lib/ export LD_LIBRARY_PATH=/usr/lib:/usr/local/lib Can I remove Akamai WAF layer, trust and rely on Discourse security protection capability?

[imagem] Hyan: Can I remove Akamai WAF layer, trust and rely on Discourse security protection capability? Yes, we recommending running Discourse without a WAF in front. Those were created to front legacy applications that had to be exposed to the web.

Thanks, @Falco. I don’t quite understand if there’s a clear border between legacy application and modern (Discourse like single page application?) when it comes to security. I need to learn more such as Defend Your SPA from Security Woes | Okta Developer to feel more solid.

Configuração do Akamai WAF e falso positivo

Suporte ao Produto

Falco (Falco) 17 Março , 2025 17:07 3

Sim, recomendamos executar o Discourse sem um WAF na frente. Estes foram criados para aplicações legadas que precisavam ser expostas à web.

Tópico		Respostas	Vistas
Cloudflare Security WAF (Web Application Firewall) + Discourse? Product Support	1	584	25 Junho , 2025
Discourse + Web Application Firewall (WAF) mod_security Self-hosting unsupported-install , hosting	8	3856	20 Novembro , 2019
Using Discourse with Cloudflare: Best Practices Self-Hosting how-to , cloudflare	28	6472	26 Abril , 2026
How to build a Discourse Installation with an Open Source WAF Self-hosting unsupported-install	1	1914	5 Outubro , 2019
ModSecurity exceptions Product Support	5	782	8 Agosto , 2019

Configuração do Akamai WAF e falso positivo

Related topics