Vercel adds WAF protection to Blob storage traffic

Vercel extended its Web Application Firewall to cover Blob storage traffic, per the company's changelog. For anyone running Blob in production, that's a security upgrade that doesn't require touching the @vercel/blob library or rewriting a single URL. It's a dashboard setting, not a migration project.

The same deny, challenge, and rate-limit rules that protect app requests now apply to Blob traffic too. Vercel evaluates them at the edge, checking IP, country, and path before any object transfer happens.

Two real limits to know before you flip it on. The OWASP Core Ruleset isn't supported here. It's built to catch attacks against dynamic application logic, not static object delivery, so it doesn't map onto Blob traffic.

Challenge rules are the other one. They require browser interaction, so they'll block legitimate server-side requests outright. A server can't complete that interaction, so skip challenge rules on any path with non-browser callers.

It's free on all plans during the beta, so testing it against a staging bucket costs nothing but time. Turn on deny and rate-limit rules now. Hold off on challenge rules until you've mapped every non-browser caller hitting your blob URLs.