FAQ: WAF, Turnstile, and Access
Answers about the roles of WAF, Turnstile, Access, rate limits, false positives, Tunnel, and application authorization.
Edited and verified by Orange Book Editorial Team ·
What problems do WAF, Turnstile, and Access solve?
WAF detects attack patterns in web requests. Turnstile adds a human-verification signal to registration, login, and submission actions. Access authenticates identity and device policy at the application entrance. None replaces user, tenant, role, or object-level authorization inside the application. See application defense.
Is Turnstile complete when the frontend widget reports success?
No. The server must send the token to Siteverify and validate the result plus expected context such as hostname and action. A token is currently valid for five minutes and can be used once. Never trust a client-supplied “verified” boolean.
Can Turnstile replace login, rate limiting, or business quota?
No. It supplies a human-verification signal for one interaction. Login still needs a secure session; APIs still require per-user and per-tenant authorization; expensive actions need rate limits, business quotas, idempotency, and audit records.
Should I disable an entire WAF ruleset after a false positive?
No. Find the rule ID, request characteristics, and timestamp in Security Events, then create the narrowest exception or skip for a verified hostname, path, method, or condition. Retest both legitimate and attack fixtures so a false-positive fix does not create a broad security gap.
Can Access protect an administration page?
Yes. Place the admin hostname or path behind an identity-aware gate and require an IdP, MFA, or device posture. Access decides who can enter; application roles and server authorization still decide who can publish, delete, or export.
Does Tunnel guarantee that an origin cannot be bypassed?
Tunnel avoids public inbound ports, but create the Access application before publishing a public hostname and validate the Access token at the origin. Remove or restrict old public routes and DNS records. See Tunnel and Access.
Is rate limiting only by IP sufficient?
Usually not. Shared NAT can cause false positives while distributed bots rotate addresses. Combine IP, user, tenant, resource, and cost dimensions for login, verification, generation, and export, with application data enforcing the final business quota.
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.