loveshell/ngx_lua_waf

Features

• NGINX Extensions - Implements security logic as a programmable extension within the Nginx request processing pipeline using Lua.
• Web Application Firewalls - Implements a web application firewall that protects services from SQL injection and XSS via real-time HTTP traffic inspection.
• Network Request Filters - Uses regular expression rules to inspect and block common web threats such as SQL injection and XSS.
• Programmable Request Filters - Provides a programmable Lua-based engine to scan HTTP headers and request bodies for malicious injection patterns.
• Regex Pattern Matching - Scans request headers and bodies against predefined regular expression rules to identify and block web attacks.
• Layer 7 Rate Limiters - Mitigates Layer 7 DDoS attacks by restricting the frequency of requests allowed from a single IP address.
• Access Control Lists - Controls network traffic by permitting or blocking requests based on defined IP white-lists and black-lists.
• IP Address Filtering - Filters network traffic by comparing client IP addresses against configured white-lists and black-lists.
• Denial of Service Prevention - Mitigates high-frequency stress testing and coordinated attacks by limiting the request rate per IP address.
• DoS Attack Defenses - Prevents server resource exhaustion by implementing defenses against flooding and DoS attack patterns.
• File Upload Security - Scans POST data and uploaded file extensions for malicious patterns to prevent injection and file-upload attacks.
• Payload Inspection - Analyzes request bodies and uploaded file extensions for malicious patterns to stop injection and file-upload threats.
• Malicious Traffic Blocking - Filters incoming network traffic to block unauthorized scanners, fuzzing attempts, and other malicious request patterns.
• Request Body Inspection - Inspects URLs, POST bodies, and cookies for malicious patterns to block abnormal network requests.
• Scanner Traffic Filtering - Inspects request methods, headers, and cookies to identify and block unauthorized scanners and malicious traffic.
• Web Attack Blocking - Filters incoming requests for common injection and fuzzing attempts using configurable regular expression rules.
• IP-Based Rate Limiting - Prevents denial of service attacks by restricting the number of requests allowed per IP address.
• Traffic Management - Controls traffic based on IP lists and concurrency limits to protect server resources from exhaustion.
• Remote Rule Synchronization - Updates firewall protection patterns by downloading and synchronizing new configuration files from a remote server.
• IP Allow/Deny Lists - Manages access to the server by permitting or blocking requests based on defined IP white-lists and black-lists.
• Path Access Restrictions - Blocks unauthorized access to sensitive archives and prevents script execution in specific directories.
• Sensitive File Protections - Blocks public web access to sensitive archives and prevents script execution in upload directories to prevent data leakage.
• Firewall Rule Synchronization - Synchronizes firewall security policies by downloading new rule files from a remote server.

Star history