Coraza is a web application firewall engine designed to filter malicious HTTP traffic using standardized security directives. It functions as a library for embedding request filtering and security transaction processing directly into web servers or reverse proxies.
The engine implements the ModSecurity WAF engine and the OWASP Core Rule Set to identify and block common web attack patterns. It utilizes a library-first integration model, allowing security capabilities to be embedded into a host process as a dependency rather than running as a standalone proxy.
The project covers rule-based pattern matching and traffic inspection through a middleware-based request pipeline. It includes capabilities for geographic traffic filtering via plugins and provides a sandbox environment for validating security rules and verifying deployments before production use.