Reference on OWASP Coraza

Internals

Tue, 06 Oct 2020 08:48:57 +0000

WAF Engine

Waf is the main interface used to store settings, rules and create transactions, most directives will set variables for Waf instances. A coraza implementation might have unlimited Waf instances and each Waf might process unlimited transactions.

Benchmarks

Tue, 06 Oct 2020 08:48:57 +0000

This page is under renovation. Updated benchmarks with the latest Coraza and ModSecurity releases will be published soon.

Body Processing

Tue, 06 Oct 2020 08:48:57 +0000

BodyBuffer

BodyBuffer is used to effectively handle large bodies. Coraza has to buffer the body in order to make reliable blocking possible. Future versions might implement a more efficient solution.

Extending

Tue, 06 Oct 2020 08:48:57 +0000

Rule Operators: Create rule operators like @even to detect even numbers
Rule Transformations: Create rule transformations like t:rot13 to encode your values in ROT13
Rule Actions: Create rule actions like challenge to redirect a malicious request to some bot detection system

The plugin interface provides three functions to extend rule operators, transformations and actions. Each one of them must match it’s proper type or interface and be registered using the plugins package.