Investigation and Resolution of Cross-Origin Errors Caused by WAF XSS Filtering in a Front‑End/Back‑End Separated System
The article recounts a real‑world incident where a JSON POST from a front‑end domain triggered a cross‑origin 418 error because a Web Application Firewall’s XSS filter mistakenly blocked a JavaScript validator field, and after the security team modified the WAF rules the issue was resolved, highlighting systematic debugging and deep knowledge of DNS, Nginx, ingress, Tomcat and WAF layers.
