Quickstart

Get the WAF running in front of a backend in about two minutes — with cargo, or with the container image.

Install

Install the waf binary straight from crates.io (needs Rust and cargo):

$ cargo install waf-proxy

Or build from source:

$ git clone https://github.com/0x00spor3/Light-WAF
$ cd Light-WAF && cargo build --release -p waf-proxy

Configure

Create a config.toml with a listener and your backend. This is the smallest useful config:

# config.toml
[proxy]
listen  = "0.0.0.0:8080"
backend = "http://127.0.0.1:3000"

[waf]
mode = "blocking"        # "blocking" enforces | "detection-only" observes and logs
block_threshold = 5      # deny when the anomaly score reaches this

Tuning a new deployment? Start with mode = "detection-only": every verdict is computed and logged, but nothing is blocked. The repository's exampleshave ready profiles from detection-only to strict. See the configuration reference for every section.

Run

$ waf --config config.toml
# or, from a source checkout:
$ cargo run --release -p waf-proxy -- --config config.toml

The WAF listens on :8080 and forwards allowed requests to your backend.

With the container image

The waf-enterprise image runs the same config — every at-scale component is off until you enable it. It reads /etc/waf/config.toml by default. Inside the container127.0.0.1 is the container itself, so point backend at an address the container can reach (for a backend on the Docker host: http://host.docker.internal:3000).

$ docker run --rm -p 8080:8080 \
    -v "$PWD/config.toml:/etc/waf/config.toml:ro" \
    ghcr.io/0x00spor3/waf-enterprise:1.0.2

Verify

A benign request is forwarded; an obvious attack is blocked with a 403:

$ curl -o /dev/null -w "%{http_code}\n" localhost:8080/
200
$ curl -o /dev/null -w "%{http_code}\n" "localhost:8080/?q=1'+OR+'1'='1"
403

Next

  • Concepts — why that request scored enough to be blocked.
  • The demo — the WAF, the dashboard and a stream of demo attacks in one docker compose up.
  • Full stack — add the control plane, the dashboard and the node agent.
← OverviewConcepts →