Coraza Usage

[dgheig]

Hi,

Looking at some examples, I am not sure to understand what coraza exactly is.
At first sight, I thought it was itself a proxy that would forward any request after having filtered them.

But apparently, this is not the case. Coraza is a lib not a software and the 2 usages are:

• Embedded the lib in your app directly
• Integrate it to a proxy

Is there a coraza app that just act as a proxy?
Would it be a good idea to great such app (either generic or per-software).

Currently, I am using nginx + ModSecurity, its only job is to forward the request it receives to another software and filter the requests, nothing more.
Thank you for the response.

[jptosso]

Hey! thank you for your interest.
We currently support two stable proxy modules:

• https://github.com/corazawaf/coraza-caddy/ (similar to nginx)
• https://github.com/corazawaf/coraza-proxy-wasm (for envoy and apisix)

In some cases you might have luck with this module https://github.com/caddyserver/nginx-adapter to load your nginx configs into caddy.

Also, Coraza works with the OWASP Core ruleset V4/dev

[dgheig]

Hi @jptosso, I am impressed by the quickness of the response.

I saw the proxy, my question is: would it be a "software" coraza instead of just a lib to integrate into other proxy?
What is the opinion against creating an app that just receive a request, check the request using coraza and forward it if the request is in order?

[jcchavezs]

I would say creating a proxy on our own is a completely different business and at our current capacity it is unlikely to happen. I think it is our best interest to deliver our integrations with major proxies like envoy or nginx. Can you achieve what you request with envoy itself?

…

On Mon, 5 Dec 2022, 16:47 dgheig, ***@***.***> wrote: Hi @jptosso <https://github.com/jptosso>, I am impressed by the quickness of the response. I saw the proxy, my question is: would it be a "software" coraza instead of just a lib to integrate into other proxy? What is the opinion against creating an app that just receive a request, check the request using coraza and forward it if the request is in order? — Reply to this email directly, view it on GitHub <#525 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXOYAUTXDIVE7MKHOFNMXTWLYFCFANCNFSM6AAAAAASUM6EFE> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[jcchavezs]

@dgheig are you still interested on this? I got an idea.

…

On Mon, 5 Dec 2022, 17:44 José Carlos Chávez, ***@***.***> wrote: I would say creating a proxy on our own is a completely different business and at our current capacity it is unlikely to happen. I think it is our best interest to deliver our integrations with major proxies like envoy or nginx. Can you achieve what you request with envoy itself? On Mon, 5 Dec 2022, 16:47 dgheig, ***@***.***> wrote: > Hi @jptosso <https://github.com/jptosso>, I am impressed by the > quickness of the response. > > I saw the proxy, my question is: would it be a "software" coraza instead > of just a lib to integrate into other proxy? > What is the opinion against creating an app that just receive a request, > check the request using coraza and forward it if the request is in order? > > — > Reply to this email directly, view it on GitHub > <#525 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AAXOYAUTXDIVE7MKHOFNMXTWLYFCFANCNFSM6AAAAAASUM6EFE> > . > You are receiving this because you are subscribed to this thread.Message > ID: ***@***.***> >

[divad1196]

@jcchavezs For which part? (I am responding with my personal account, @dgheig is my university account that I used by mistake)
I discovered coraza when looking for alternative WAF and I wasn't sure how it was meant to be used.
I wanted to understand the use case which was to be embedded into a proxy (caddy for example).

My second question was: What if my app is just a proxy (it receive a request, and forward it somewhere else. Maybe it would do something with the request/response in between, but not necessarily), would it be a good idea?
The main reason was that, sometimes I (feel I) need a WAF for a single app, but not for all apps behind the proxy:
This would let me have a better control over the rules, specifically for my app, and not impact other apps that doesn't need the WAF.

I am not sure if there is something to be generalized here, but I am curious to ear your idea.