Vercel WAF for Blob is now in beta
By Steven Van ·
The beta works on all plans with no code changes, though challenge rules block server-side @vercel/blob requests since they need a browser.
The Vercel WAF can now protect a Vercel Blob store, in beta on all plans. The same deny, challenge, and rate limit rules that guard deployments now apply to blob traffic, with no changes to code, blob URLs, or @vercel/blob. Since every blob is already served through Vercel's CDN, protection is a switch on the store rather than a new proxy.
- Deny returns a 403 and stops the request early, so no data transfer is incurred.
- Challenge serves the standard browser challenge, and a request that fails it is blocked.
- Rate limit returns a 429 when a client exceeds the set limit.
- Redirect and log behave as they do for deployment traffic.
Rules evaluate at the edge, matching on IP, country, path, and more. The OWASP Core Ruleset is not supported, since it targets dynamic application traffic rather than object delivery.
Setup is a single switch in the dashboard: open the Blob store, go to Settings, then Protect your store. Vercel connects it to a shared vercel-blob-default-project on the team, and rules are written with the standard rule builder and take effect immediately. One rule set covers every protected store, so rules can't be scoped per store. During the beta, setup is dashboard-only, and since challenges need a browser to solve, server-side @vercel/blob requests that match a challenge rule are blocked; challenge rules are meant for browser traffic.
