Comments (5)
Hi, I don't know much about Gin, but wouldn't be possible consume Coraza as a http/middleware like in the http-server example?
Edit: it is not 😕
from coraza.
Unfortunately frameworks like Gin and others define their own handler / middleware interfaces and don't use http.Handler
.
We currently have http middleware with this private method for handling an http.Request
https://github.com/corazawaf/coraza/blob/main/http/middleware.go#L26
It could be reasonable to expose that for processing a request, however the bigger challenge is processing a response, in that middleware we also wrap the response writer to be able to process it, which is significantly more complex
https://github.com/corazawaf/coraza/blob/main/http/interceptor.go
Since Gin has a custom response type, we couldn't provide a drop-in helper for that in the http
package I think as it would require gin-specifics. I don't know if we would want to expose help with only the request side without the response side.
What does come to mind is exposing something like this
// Handle processes the HTTP request applying the WAF rules. We replace the http.ResponseWriter,
// and may need to replace the request in the future, so it is important to make sure next does not ignore
// the parameters passed to it.
func Handle(waf coraza.WAF, w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
Then in gin middleware would still need to have its own custom gin.ResponseWriter
but maybe it's not that complicated when using the http.ResponseWriter
we pass into next
. Would this be enough with the Gin usecase? I think it could be reasonable to expose.
from coraza.
I understand why a WAF scans the Request input, why does it need to parse the response of my app?
It might be possible to prevent data leakages matching common patterns like common errors and warnings that are printed in the response when the database/application is not behaving as intended. So, even if for any reason the malicious payload went through, there is another enforcement point where it is possible to drop the response and effectively deny the attack.
In order to see some rules dealing with the response, you may go through the rule files starting with RESPONSE-*
in the CRS repo or even just looking at files like sql-errors.data.
from coraza.
Wanted to use Coraza with Echo by adapting the Gin example. Stumbled across the same problem with missing request handle method.
On that topic of integration:
I'm new to the idea of WAFs, I understand why a WAF scans the Request input, why does it need to parse the response of my app?
from coraza.
Thanks that helped!
Now I hope even more that Coraza will expose an API so Gin/Echo/Fiber users on Go can use it in their applications as a middleware.
from coraza.
Related Issues (20)
- Chain rule for excluding matched_var_name HOT 1
- Incomplete Anomaly Score Log: Missing Value for 'msg' Field with Rule ID 980170 HOT 1
- FP in sql injection and unciode code is showing as unsupported directive HOT 1
- ARGS with regular expression should be case-sensitive match. HOT 2
- Variable names should be case sensitive per RFC 3986 HOT 3
- Add two new security verification functions to achieve flexible use of security verification HOT 4
- SecRequestBodyLimitAction Reject should be invoked only if content-length is greater than SecRequestBodyLimit HOT 6
- Action 'exec' does not work HOT 1
- Fuzz tests #469 failed HOT 1
- Fuzz tests #470 failed HOT 1
- Allow action generates logs in DetectionOnly mode HOT 2
- Fuzz tests #471 failed
- Fuzz tests #472 failed HOT 1
- “setvar:ip.docs_block-counter” Unable to resolve HOT 3
- Audit Logs are not indicating all matches
- Fuzz tests #516 failed
- Race condition in RuleMetadata.StrID() HOT 1
- [coraza.conf-recommended] Align Json processing on request & response
- ParseVariables function parses regular expressions with escape characters incorrectly
- Add support for GraphQL HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from coraza.