WSLProxy

Edge security · OpenResty hot path

WAF & security that operators can explain

Bind policies per domain and route. Run in monitor or block. Stage signatures safely. Every decision names the policy, binding, stage, signature, and a support ID — fail-open by default so a WAF bug never takes the site down.

Engine reference WAF API (Swagger) Demo pack
  • 37+ shipped attack signatures
  • 8 first-class inspection stages
  • Block or monitor per binding
  • Rate limit · CAPTCHA · JWT / geo / IP
Capability surface

Everything security needs at the POP

Not a regex snippet — a governed policy engine with stable signature IDs, anomaly scoring, and structured events.

Policy packs

Bind a WAF policy to a virtual host. Override mode per server or longest-prefix route. Logical service labels ride in every log line.

Monitor or block

Transparent (alarm) and blocking enforcement modes. Route overrides let /preview stay in monitor while /api/pay blocks.

Anomaly scoring

Each signature contributes a score. When the cumulative total crosses the policy threshold, VIOL_ANOMALY_SCORE fires — even if no single rule alone would block.

Signature governance

Disable by ID, stage until a timestamp (alarm-only), or toggle whole sets (SET_SQLI, SET_XSS…). Staged rules never inflate anomaly scores.

Body inspection

JSON depth and size profiles, XXE / SSTI / mass-assignment signatures, and optional parse hardening on the request path.

Explainable blocks

Response headers X-WAF-Block, X-WAF-Rule, X-WAF-Violation, X-Support-ID plus a block page that embeds the correlation ID.

Request path

Stage pipeline, then signatures

After rule match and rate limit, waf_engine.inspect runs first-class stages, then governed signature matching — each stage is fail-open under pcall.

  1. VIOL_METHOD
    Method allow-list

    Reject verbs outside the policy allow set (for example GET / POST / HEAD / OPTIONS only).

  2. VIOL_FILETYPE
    Filetype deny

    Block paths ending in sensitive extensions — .env, .sql, .bak, .git, .pem, and more.

  3. VIOL_SMUGGLING
    HTTP smuggling / desync

    CL+TE coexistence, duplicate or obfuscated Transfer-Encoding, malformed Content-Length — plus a body signature for pipelined request lines.

  4. VIOL_IP_DENY · VIOL_GEO
    IP lists & geo deny

    CIDR allow/deny lists and country deny via IP2Location on the hot path.

  5. VIOL_JWT_ALG
    JWT algorithm policy

    Deny none / weak algs; require RS256 or ES256 for APIs that carry bearer tokens.

  6. VIOL_JSON_*
    JSON body profile

    Max depth and max bytes before the request reaches your origin.

  7. VIOL_BRUTE_FORCE
    Brute-force velocity

    Per-path windows (for example /api/login) keyed by IP — block or alarm when attempts exceed the budget.

  8. VIOL_OPENAPI_*
    OpenAPI positive security

    Declared path + method allow-list with path templating — unknown surface never reaches the backend.

Signature library

Attack categories shipped with the product

Stable IDs under data/waf_rules/ — seedable via API, editable in Admin UI, pullable with wslproxy-cli.

SQLi XSS Command injection LFI / path traversal SSRF SSTI XXE NoSQL injection Log4Shell Spring4Shell JWT none GraphQL introspection Open redirect Prototype pollution Mass assignment HTTP smuggling Scanner user-agents Protocol abuse

Each signature declares category, severity, match target (url · args · body · headers · cookies · user_agent · all), action, and anomaly score. Policies attach rule IDs; sets group them for bulk block/alarm toggles.

Beyond the WAF engine

Layered controls on the same edge

Security is not only signatures — routing rules and gateway pipeline features close the gaps attackers use.

Per-server rate limiting

Shared-dict rate limits with requests-per-second and burst — applied in the gateway pipeline before expensive origin work.

CAPTCHA challenge (306)

Rule status 306 serves Turnstile or reCAPTCHA until a signed cookie proves the client cleared the challenge, then continues as a normal proxy (305).

Rule-level auth matches

JWT validation, Amazon S3 signing checks, and cookie key-value gates on the rule matcher — deny before the backend ever sees the request.

Geo & IP rule match

Independent of WAF geo stages: route or block by country and client CIDR with equals / not-equals keys on live rules.

Operate & prove

Built for security and platform teams

Govern in UI or GitOps. Validate in CI. Ship events to your SIEM.

Admin UI

WAF Policies and WAF Rules forms cover v2 fields — bind to servers, override mode, review events.

REST · MCP · CLI

CRUD via Swagger, bind policies from MCP tools, wslproxy-cli pull/push for waf_rules and waf_policies.

CI validation

tools/waf_validate.py + waf-validate workflow — Lua syntax, JSON Schema policies, signature referential integrity.

Observability

Structured wafsec JSON logs, Prometheus counters (waf_blocked, waf_monitored, latency), recent events API.

Next step

Put a policy on your edge

Read the engine design, seed rules in your profile, bind a policy to a server, and start in monitor mode before you flip to block.

Read WAF Engine v2 GitHub Back to home