A WAF evaluates web traffic reaching the server; in-app protection evaluates client execution. The two systems collect information at different observation points.
Evaluation approach
A WAF alone may not know whether a seemingly valid request came from modified mobile code. A client-side check cannot repair a server-side authorization defect either.
Application example
Correlate the mobile transaction identifier, verified integrity evidence and gateway decision within one tracing context. Connect the records without needlessly duplicating raw security data.
Limits and considerations
Reporting a WAF block as a RASP success, or a client detection as successful API authorization, distorts the measurements.
Both sides of an encrypted request
A WAF examines a request as it arrives at the server. It cannot always see that a decision inside the client was altered earlier. RASP can observe application context, but it does not know the access relationships in the server's database.
Bind device-generated risk information to the server-side session and transaction identifiers. Passing through a gateway does not establish object-level authorization; the application service must enforce that decision too. Each layer examines a different aspect of the same operation.
Checks and decisions
- Draw the trust boundary
- Verify client evidence
- Maintain API authorization
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.