Coraza

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

Programming language: Go

License: Apache License 2.0

Tags: Security    

README

  Coraza - Web Application Firewall

[](#)

Notice: Coraza v3 is on pre-alpha stage and APIs might change ! :warning:

Coraza is an open source, enterprise-grade, high performance Web Application Firewall (WAF) ready to protect your beloved applications. It written in Go, supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set.

• Website: https://coraza.io
• Forum: Github Discussions
• OWASP Slack Community (#coraza): https://owasp.org/slack/invite
• Rule testing: Coraza Playground
• Planning: Github Projects

Key Features:

• ⇲ Drop-in - Coraza is a drop-in alternative to replace the soon to be abandoned Trustwave ModSecurity Engine and supports industry standard SecLang rule sets.

• 🔥 Security - Coraza runs the OWASP Core Rule Set (CRS) to protect your web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. CRS protects from many common attack categories including: SQL Injection (SQLi), Cross Site Scripting (XSS), PHP & Java Code Injection, HTTPoxy, Shellshock, Scripting/Scanner/Bot Detection & Metadata & Error Leakages.

• 🔌 Extensible - Coraza is a library at its core, with many integrations to deploy on-premise Web Application Firewall instances. Audit Loggers, persistence engines, operators, actions, create your own functionalities to extend Coraza as much as you want.

• 🚀 Performance - From huge websites to small blogs, Coraza can handle the load with minimal performance impact. Check our Benchmarks

• ﹡ Simplicity - Anyone is able to understand and modify the Coraza source code. It is easy to extend Coraza with new functionality.

• 💬 Community - Coraza is a community project, contributions are accepted and all ideas will be considered. Find contributor guidance in the CONTRIBUTION document.

Integrations

The Coraza Project maintains implementations and plugins for the following servers:

• Caddy Reverse Proxy and Webserver Plugin - stable, needs a maintainer
• Proxy WASM extension for proxies with proxy-wasm support (e.g. Envoy) - stable, still under development
• HAProxy SPOE Plugin - preview
• Traefik Proxy Plugin - preview, needs maintainer
• Gin Web Framework Middleware - preview, needs maintainer
• Apache HTTP Server - experimental
• Nginx - experimental
• Coraza C Library - experimental

Plugins

• Coraza GeoIP (preview)

Roadmap

• WASM scripts support
• New rule language
• GraphQL body processor
• TinyGo support
• libcoraza C exports

Prerequisites

• Golang compiler v1.18+
• Linux distribution (Debian or Centos recommended) or Mac. Windows not supported yet.

Coraza Core Usage

Coraza can be used as a library for your Go program to implement a security middleware or integrate it with existing application & webservers.

package main

import (
    "fmt"
    "github.com/corazawaf/coraza/v3"
)

func main() {
    // First we initialize our waf and our seclang parser
    waf, err := coraza.NewWAF(coraza.NewWAFConfig().
        WithDirectives(`SecRule REMOTE_ADDR "@rx .*" "id:1,phase:1,deny,status:403"`))
    // Now we parse our rules
    if err != nil {
        fmt.Println(err)
    }

    // Then we create a transaction and assign some variables
    tx := waf.NewTransaction()
    defer func() {
        tx.ProcessLogging()
        tx.Close()
    }()
    tx.ProcessConnection("127.0.0.1", 8080, "127.0.0.1", 12345)

    // Finally we process the request headers phase, which may return an interruption
    if it := tx.ProcessRequestHeaders(); it != nil {
        fmt.Printf("Transaction was interrupted with status %d\n", it.Status)
    }
}

[Examples/http-server](./examples/http-server/) provides an example to practice with Coraza.

Tools

• Go FTW: Rule testing engine
• Coraza Playground: Sandbox rule testing web interface
• OWASP Core Ruleset: Awesome rule set, compatible with Coraza

Development

Coraza only requires Go for development. You can run mage.go to issue development commands.

See the list of commands

go run mage.go -l

For example, to format your code before submission, run

go run mage.go format

Contribute

Contributions are welcome! Please refer to [CONTRIBUTING.md](./CONTRIBUTING.md) for guidance.

Thanks

• Modsecurity team for creating ModSecurity
• OWASP Coreruleset team for the CRS and their help

Companies using Coraza

• Babiel (supporter)

Author on Twitter

• @jptosso

Donations

For donations, see Donations site

Thanks to all the people who have contributed

We could not have done this without you!

Made with contrib.rocks.