request help: do you have any plan to add waf feature?

[UnderTreeTech]

Issue description

Do you have any plan to add waf to defend attacks like XSS, SQL Injection, WebShell?

[shuaijinchao]

Hello, APISIX already supports the IP black and white list function, please see IP Restriction Plugin

[UnderTreeTech]

I mean support anti xss, sql injection, webshell upload and etc but not only IP Restriction. @shuaijinchao WAF is more complicated than IP Restriction.

[membphis]

@UnderTreeTech welcome PR for them

we have supported the IP Restriction and URI blocker now.

[moonming]

@UnderTreeTech yes, Apache APISIX need WAF features. Maybe we can add plugin like modsecurity?

[yimingsir]

hope apisix integrated with modsecurity

[tokers]

hope apisix integrated with modsecurity

PRs are welcome.

[lukasmrtvy]

Proly doable with go-runner and https://github.com/corazawaf/coraza

[tao12345666333]

Trustwave is announcing the End-of-Life (EOL) of our support for ModSecurity effective July 1, 2024. We will then hand over the maintenance of ModSecurity code back to the open-source community.

https://www.modsecurity.org/

Maybe this is not the best option?

[Sn0rt]

@UnderTreeTech https://apisix.apache.org/blog/2023/09/08/APISIX-integrates-with-Coraza/

hi. have you try coraza wasm plugin by follow this guide ?

[moonming]

Apache APISIX already supports:

• Coraza: https://apisix.apache.org/blog/2023/09/08/APISIX-integrates-with-Coraza/
• chaitin: https://apisix.apache.org/docs/apisix/plugins/chaitin-waf/