About OWASP Coraza
OWASP Coraza is an open source web application firewall for APIs and web applications. It is an OWASP production project and is written in Go.
What it does
Coraza inspects requests and responses against rule sets, and it is compatible with the OWASP Core Rule Set. It can run as a sidecar, a proxy or a library, which suits modern container and gateway setups. The project describes it as a drop-in option for teams that already use ModSecurity rule sets.
Key features
- Works with the OWASP Core Rule Set
- Runs as a sidecar, proxy or library
- Connectors for Envoy, NGINX, HAProxy and Caddy
- Plugin system for custom rules and operators
- Runs in Go, C++ and WebAssembly
Who it's for
Coraza suits platform engineers, Go developers and infrastructure teams who run gateways such as Envoy or NGINX. Teams that run a single simple website may find a hosted firewall easier to manage.
Pricing and good to know
Coraza is licensed under Apache-2.0 and is free to use. It belongs to the OWASP project family, and the site links to a GitHub repository, a Slack community and an online playground. Setup needs some configuration, such as the rules file for your gateway, so test it in staging before turning on blocking.
Highlights
- Works with the OWASP Core Rule Set
- Runs as a sidecar, proxy or library
- Connectors for Envoy, NGINX, HAProxy and Caddy
- Plugin system for custom rules and operators
- Runs in Go, C++ and WebAssembly
