Web Application Firewall control now available with vercel.json

You can now control Vercel’s Web Application Firewall (WAF) actions directly in vercel.json, alongside existing support in the dashboard, API, and terraform.

This approach provides a structured way for both developers and agents to declaratively define and push rules to projects. Agents can use code-generating prompts to author new rules that are easily injected into the project’s vercel.json.

The has and missing matchers have also been enhanced to support more expressive conditions across headers, rewrites, redirects, and routes. Matching options include:

• String equality and inequality

• Regular expressions

• Prefixes and suffixes

• Inclusion and exclusion from string arrays

• Numeric comparisons

The following example shows how to deny a request that is prefixed by a specific header:

1
{
2
  "$schema": "https://openapi.vercel.sh/vercel.json",
3
  "routes": [
4
    {
5
      "src": "/(.*)",
6
      "has": [
7
        {
8
          "type": "header",
9
          "key": {
10
            "pre": "x-bad-header-"
11
          }
12
        }
13
      ],
14
      "mitigate": {
15
        "action": "deny"
16
      }
17
    }
18
  ]
19
}

Read more about Vercel's WAF and configuring WAF rules in vercel.json.