Coraza - Web Application Firewall

Coraza is an open source, enterprise-grade, high performance Web Application Firewall (WAF) ready to protect your beloved applications. It written in Go, supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set.

• Website: https://coraza.io
• Forum: Github Discussions
• OWASP Slack Community (#coraza): https://owasp.org/slack/invite
• Rule testing: Coraza Playground
• Planning: Github Projects

Key Features:

• ⇲ Drop-in - Coraza is a drop-in alternative to replace the soon to be abandoned Trustwave ModSecurity Engine and supports industry standard SecLang rule sets.

• 🔥 Security - Coraza runs the OWASP Core Rule Set (CRS) to protect your web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. CRS protects from many common attack categories including: SQL Injection (SQLi), Cross Site Scripting (XSS), PHP & Java Code Injection, HTTPoxy, Shellshock, Scripting/Scanner/Bot Detection & Metadata & Error Leakages.

• 🔌 Extensible - Coraza is a library at its core, with many integrations to deploy on-premise Web Application Firewall instances. Audit Loggers, persistence engines, operators, actions, create your own functionalities to extend Coraza as much as you want.

• 🚀 Performance - From huge websites to small blogs, Coraza can handle the load with minimal performance impact. Check our Benchmarks

• ﹡ Simplicity - Anyone is able to understand and modify the Coraza source code. It is easy to extend Coraza with new functionality.

• 💬 Community - Coraza is a community project, contributions are accepted and all ideas will be considered. Find contributor guidance in the CONTRIBUTION document.

Integrations

The Coraza Project maintains implementations and plugins for the following servers:

• Caddy Reverse Proxy and Webserver Plugin (stable, needs a maintainer)
• HAProxy SPOE Plugin (preview)
• Traefik Proxy Plugin (preview, needs maintainer)
• Gin Web Framework Middleware (preview, needs maintainer)
• Apache HTTP Server (experimental)
• Nginx (experimental)
• Coraza C Library (experimental)
• Buffalo Web Framework Middleware (planned)

Plugins

• Coraza GeoIP (preview)

Roadmap

• WASM scripts support
• New rule language
• GraphQL body processor
• TinyGo support
• libcoraza C exports

Prerequisites

• Golang compiler v1.16+
• Linux distribution (Debian or Centos recommended, Windows not supported yet)

Coraza Core Usage

Coraza can be used as a library for your Go program to implement a security middleware or integrate it with existing application & webservers.

package main

import(
	"fmt"
	"github.com/corazawaf/coraza/v2"
	"github.com/corazawaf/coraza/v2/seclang"
)

func main() {
	// First we initialize our waf and our seclang parser
	waf := coraza.NewWaf()
	parser, _ := seclang.NewParser(waf)

	// Now we parse our rules
	if err := parser.FromString(`SecRule REMOTE_ADDR "@rx .*" "id:1,phase:1,deny,status:403"`); err != nil {
		fmt.Println(err)
	}

	// Then we create a transaction and assign some variables
	tx := waf.NewTransaction()
	defer func(){
		tx.ProcessLogging()
		tx.Clean()
	}()
	tx.ProcessConnection("127.0.0.1", 8080, "127.0.0.1", 12345)

	// Finally we process the request headers phase, which may return an interruption
	if it := tx.ProcessRequestHeaders(); it != nil {
		fmt.Printf("Transaction was interrupted with status %d\n", it.Status)
	}
}

Tools

• Go FTW: rule testing engine
• Coraza Playground: sandbox rule testing web interface
• OWASP Core Ruleset: Awesome rule set, compatible with Coraza

Troubleshooting

Dependency issues:

go get: github.com/jptosso/coraza-waf/[email protected]: parsing go.mod:
	module declares its path as: github.com/corazawaf/coraza/v2
	        but was required as: github.com/jptosso/coraza-waf/v2

Coraza was migrated from github.com/jptosso/coraza-waf to github.com/corazawaf/coraza. Most dependencies has already been updated to use the new repo, but you must make sure they all use v2.0.0-rc.3+. You may use the following command to fix the error:

go get -u github.com/corazawaf/coraza/[email protected]

Contribute

Contributions are welcome! Please refer to CONTRIBUTING.md for guidance.

Thanks

• Modsecurity team for creating ModSecurity
• OWASP Coreruleset team for the CRS and their help

Companies using Coraza

• Babiel (supporter)

Author on Twitter

• @jptosso

Donations

For donations, see Donations site

Thanks to all the people who have contributed

We could not have done this without you!

Made with contrib.rocks.