OWASP Coraza - Web Application Firewall
summary
Coraza claims drop‑in compatibility with the OWASP Core Rule Set while serving cloud‑native deployments, showing 4 million requests in 8 minutes on a 32‑core test and reporting that it runs up to 15x faster than typical WAFs; it embeds CRS, compiles to WebAssembly and ships connectors for Envoy, Kong, Traefik, Caddy and Ambassador (experimental C connector exists); limitations include no native Apache/NGINX module, difficulty with WebSockets and gRPC/protobuf, lack of real training data for ML, and planned features like a new rule language and dynamic rule execution.
AI-written summary · about
chapters (17)
- 0:00OWASP Coraza WAF intro
- 1:04WAF history and evolution
- 3:32Modern WAF challenges
- 5:45Coraza core values
- 7:51Coraza technical workings
- 8:54Coraza connectors
- 11:03Coraza performance
- 13:14WAF security challenges
- 16:45API security threats
- 18:52ML in WAF solutions
- 21:22Out-of-band WAF impact
- 23:07Coraza rule limits
- 24:32SELang evolution
- 26:00New protocols limits
- 28:09Coraza future roadmap
- 29:58Legacy support focus
- 31:05Benchmarking performance
related talks
53mOWASP Coraza: Open Source WAF for Cloud Native Service Mesh
23mCoraza Web Application Firewalls Revisited
38mWeb Application Firewalls Revisited
55mOWASP Coraza: The Way To WAF In 2023
46mIt is rough without a WAF
37mSecuring Modern Apps with Zero Trust and Next-Gen Web Application Firewall- 37mSecuring Modern Apps with Zero Trust and Next-Gen Web Application Firewall
11mLightning Talk: Use Wasm to Deploy WAF Deeper in the Service Mesh for Zero Trust and...