I also suspect this to be the case. However, the reason you get a WAF is because you either want a security blanket or don't have the resources to implement the service in a "good" or... even: "decent" language ;).