// Module included in the following assemblies:
//
// * cloud_experts_tutorials/cloud-experts-using-cloudfront-and-waf.adoc

:_mod-docs-content-type: PROCEDURE
[id="cloud-experts-using-cloudfront-and-waf-test-waf_{context}"]
= Test the WAF

[role="_abstract"]
Verify that your AWS Web Application Firewall (WAF) configuration is working by sending valid and malicious requests to the sample application.

.Procedure
. Test that the application is accessible behind Amazon CloudFront:
+
.Example
[source,terminal]
----
$ curl "https://hello-openshift.${DOMAIN}"
----
+
.Example output
[source,text]
----
Hello OpenShift!
----

. Test that the WAF denies a bad request:
+
.Example
[source,terminal]
----
$ curl -X POST "https://hello-openshift.${DOMAIN}" \
  -F "user='<script><alert>Hello></alert></script>'"
----
+
.Example output
[source,text]
----
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>ERROR: The request could not be satisfied</TITLE>
</HEAD><BODY>
<H1>403 ERROR</H1>
<H2>The request could not be satisfied.</H2>
<HR noshade size="1px">
Request blocked.
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
<BR clear="all">
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
<BR clear="all">
<HR noshade size="1px">
<PRE>
Generated by cloudfront (CloudFront)
Request ID: nFk9q2yB8jddI6FZOTjdliexzx-FwZtr8xUQUNT75HThPlrALDxbag==
</PRE>
<ADDRESS>
</ADDRESS>
</BODY></HTML>
----
+
The expected result is a `403 ERROR`, which means the AWS WAF is protecting your application.