Trying to attack the Vercel Firewall

I put the new Vercel Firewall to the test, attacking my site with 60,000 requests. The Firewall is available for free on all Vercel plans.

0:00 – Demo
7:39 – What the Firewall protects
10:51 – Custom Rules
12:05 – Instant Rollbacks
12:26 – Conclusion

#vercel

[bournejason]

Cloudflare's JA4 feature is paid only, nicely done vercel

[ylmazcandelen]

I don't understand people who trying to downplay this feature, it was what devs(maybe not all but) needed and you guys delivered. Thank you!

[AndreasFroyland]

Wow! I love this. Great work, Vercel. Rob is an absolute beast educator

[mm]

Vercel just keeps delivering. It’s like having a better Cloudflare now in a Tab 🔥👏🏻

[flnnx]

The rate limit 🔥🔥🔥🔥🔥🔥. Can't wait

[venzkie]

Happy to see this new feature, necessarily needed.

[Daniel-hzpt]

Okay this initially seemed like kind of a mediocre feature video… “let’s block by user agent!” I almost switched off, then you rolled out JA4.. really really nice work, that turned it around, this is a really cool product/feature, I’d also be interested in seeing the OWASP firewall rules that seem to be enterprise only

[DevSrijit]

This is amazing ! Vercel is bringing the CloudFlare features right into the PaaS !

[GabrielSestrem]

Amazing. This is helping us specially on getting SOC 2

[beloaded]

This was immensely useful. Thanks for showing us this Mr Robinson

[mihajlomk]

Is there any way to automate the blocking, rate limiting or assigning the challege?

[andrewizbatista]

Amazing work, excited to try this out.

[coleblender]

It doesn't give me the options to rate limit. Is this available yet?

[hackhoster]

why is this not available in my vercel account *Rate Limit

[auckii]

Should we migrate everything to vercel rather than adding in cloudflare as a dns/ddos manager ?

[deansacramone]

WHERE is the Rate Limit? Doesn't seem to be available.

[yarapolana]

Vercel should add “Save & Publish” or emergency mode where it activates automatically

[ionelCristianLupu_]

Can't attackers just make the requests have a different JA4 fingerprint every time?

[deansacramone]

Would this also be good to use against Bots that are not meaning anything "bad", BUT its causing spikes in pricing etc...? because its scrapping a bunch of my pages?

[reallions]

Excellent. Does this mean Cloudflare is not needed anymore for human proof? And Redis is not needed for rate limiting?