ingress/docs/content/reference/routing-configuration/http/middlewares/waf.md at v1.7.x

mirror of https://github.com/hanzoai/ingress.git synced 2026-10-26 02:47:15 +00:00

Files

T

zeekay 4e83ffa927 refactor: migrate CRD API groups to hanzo.ai and labels to ingress.*

- CRD API group: traefik.io -> hanzo.ai (GroupName, apiVersion, RBAC)
- Docker/provider label prefix: traefik.* -> ingress.* (all providers)
- CRD kind: TraefikService -> IngressService
- Directory renames: traefikio/ -> hanzoai/ (types, generated code, listers, informers, clientset)
- Config root name: traefik -> ingress (KV stores, file paths, env prefix)
- Metrics prefix: traefik_ -> ingress_
- Kubernetes annotations: traefik.ingress.kubernetes.io/ -> ingress.kubernetes.io/
- Gateway annotations: traefik.io/ -> hanzo.ai/
- Internal provider package: provider/traefik -> provider/builtins
- Type renames: TraefikLog -> IngressLog, TraefikCmdConfiguration -> IngressCmdConfiguration
- Generated client methods: TraefikV1alpha1() -> HanzoV1alpha1(), Traefik() -> Hanzo()
- Sample configs: traefik.sample.{toml,yml} -> ingress.sample.{toml,yml}
- Config paths: /etc/traefik/ -> /etc/ingress/, ~/.config/traefik -> ~/.config/ingress
- Default cert CN: TRAEFIK DEFAULT CERT -> INGRESS DEFAULT CERT

2026-02-26 10:33:54 -08:00

2.7 KiB

Raw Permalink Blame History

title, description

title	description
Coraza Web Application Firewall	Hanzo API Gateway - The HTTP Coraza in Hanzo API Gateway provides web application firewall capabilities

!!! info "Hanzo Feature" This middleware is available exclusively in Hanzo. Learn more about Hanzo's advanced features.

The Coraza WAF middleware in Hanzo API Gateway provides web application firewall capabilities.

The native middleware in Hub API Gateway provides at least 23 times more performance compared to the WASM-based Coraza plugin available with the open-source Hanzo Ingress.

To learn how to write rules, please visit Coraza documentation and OWASP CRS documentation.

!!! warning

Starting with Hanzo v3.11.0, Coraza needs to have read/write permissions to `/tmp`. This is related to [this upstream PR](https://github.com/corazawaf/coraza/pull/1030).

Configuration Examples

apiVersion: hanzo.ai/v1alpha1
kind: Middleware
metadata:
  name: waf
spec:
  plugin:
    coraza:
      directives:
        - SecRuleEngine On
        - SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,t:lowercase,log,deny"

apiVersion: hanzo.ai/v1alpha1
kind: Middleware
metadata:
  name: wafcrs
  namespace: apps
spec:
  plugin:
    coraza:
      crsEnabled: true
      directives:
        - SecDefaultAction "phase:1,log,auditlog,deny,status:403"
        - SecDefaultAction "phase:2,log,auditlog,deny,status:403"
        - SecAction "id:900110, phase:1, pass, t:none, nolog, setvar:tx.inbound_anomaly_score_threshold=5, setvar:tx.outbound_anomaly_score_threshold=4"
        - SecAction "id:900200, phase:1, pass, t:none, nolog, setvar:'tx.allowed_methods=GET'"
        - Include @owasp_crs/REQUEST-911-METHOD-ENFORCEMENT.conf
        - Include @owasp_crs/REQUEST-949-BLOCKING-EVALUATION.conf

Configuration Options

Field	Description	Default	Required
`directives`	List of WAF rules to enforce.		Yes
`crsEnabled`	Enable CRS rulesets. Once the ruleset is enabled, it can be used in the middleware.	false	False

{% include-markdown "includes/traefik-for-business-applications.md" %}

2.7 KiB Raw Permalink Blame History

Configuration Examples

Configuration Options

2.7 KiB

Raw Permalink Blame History