operational guidance (from Curry and Shah's ForgeRock write-up, Nov 7)
Tip: if a WAF is the only thing hiding an admin console, test it with %2f, dot segments and ;-parameters, then remove the console
For each blocked admin route, request variants under an allowed prefix: %2f instead of /, /..;/, ; path parameters and doubled encodings, and compare status codes. A 401 where you expected a 403 means the request got through to the app.
Don't treat the WAF as authentication. Remove admin consoles you don't need in production, bind the rest to an internal interface, and change default credentials.
Alert on %2f..; and ..;/ in access logs; legitimate clients rarely send them.