Apache-2.0, no enterprise edition
The reverse proxy with a firewall and a console
Put every site behind one Go gateway, with HTTPS, rules and single sign-on, managed from the browser.
CasWAF takes the place of Nginx in front of your web applications. Add a site in the console, give it a domain and the address of the application, attach a certificate and some rules, and every gateway node picks it up within seconds. No configuration files, no reloads.
$ git clone https://github.com/caswaf/caswaf && cd caswaf/web && yarn install && yarn build && cd .. && go build -o caswaf . && sudo ./caswaf -createDatabase=trueNeeds Go, Node.js, MySQL and a Casdoor application. The console runs on port 17000.
How a request goes through
CasWAF- 1Serve HTTPS with the matching certificate
- 2Record the request
- 3Redirect, and ask for a login if set
- 4Check the site's rules in order
What it does today
Many sites, one gateway
Route each domain to its application, with extra domains, www and trailing-slash redirects, several upstreams, or a folder of static files. WebSockets and HTTP/2 included.
Read moreHTTPS without the chores
Certificates picked by domain for every connection, wildcards serving every subdomain, Let’s Encrypt certificates issued and renewed for you, HSTS and secure cookies added.
Read moreRules in front of every site
Block or allow by IP range, traffic from abroad, User-Agent and path, rate-limit each address, run ModSecurity rules on the Coraza engine, or send doubtful visitors through a CAPTCHA.
Read moreSingle sign-on, for you and your sites
The console signs in through Casdoor, with MFA, LDAP, SAML and social logins. Put any internal tool behind a Casdoor login without changing a line of it.
Read moreSee what comes in
Every request recorded, a dashboard of traffic per site over time with the top addresses and crawlers, and an email or SMS when a site stops answering.
Read moreSeveral nodes, one configuration
Run the gateway on as many machines as you like against one database. Each serves every site, and each can update itself from Git.
Read moreHow it compares
One page per tool it replaces or gets weighed against.
SafeLine
A GPL-3.0 WAF with its own detection engine and a free tier capped at 10 applications.
Read moreModSecurity
An Apache-2.0 WAF engine that embeds in Nginx, Apache or IIS, with no console of its own.
Read moreBunkerWeb
An AGPL-3.0 WAF built on Nginx, with the OWASP Core Rule Set on by default and a paid Pro edition.
Read moreNginx
A BSD-2-Clause web server and reverse proxy with no firewall, console or SSO of its own.
Read moreOpen source, all of it
Nothing held back
No paid edition with the rules, the console or single sign-on locked away. What is in the repository is the product.
Settings you can query
Sites, certificates and rules are rows in your database, so they can be backed up, audited and changed by your own scripts.
Built in the open
Next: deploying any application from Git, wildcard certificates from the console, roles in the console, and richer request records.