2 min lesson
WAF, TLS termination and mTLS to origin
Work through the cases in "WAF, TLS termination and mTLS to origin", pairing each signal with the move that fits.
Step 1 of 2
WAF, TLS termination and mTLS to originwhere encryption ends and where trust begins
TLS should terminate at the edge for handshake latency, then a fresh, mutually authenticated TLS session should carry the request to origin. Terminating once at the edge and sending plaintext over your backbone is the cheap mistake that fails a security review.
Managed rule sets for OWASP Top 10: SQLi, XSS, path traversal.
Custom rules for your shapes: oversized payloads, malformed auth headers, suspicious user agents.
Run in count mode first, then enforce, so you don't 403 real users on day one.
Terminate TLS 1.3 at the edge POP near the user.
Re-encrypt edge→origin; ideally mTLS so origin only trusts the edge.
Then mTLS again service-to-service inside the mesh.
The governing principle: enforce security and rate limiting as far from origin as you can. Every request you reject or serve at the edge is compute, bandwidth and GPU time you didn't spend. At 1M+ DAU, shedding 5% of abusive traffic at the edge is a real line item, not a rounding error.
Open the design by drawing the layers and stating your defense-in-depth posture: "TLS at the edge, WAF and rate limiting before origin, mTLS to origin, mTLS in the mesh." It shows you think in layers, not in a single firewall and it frames every later decision as "which layer owns this?"