Blog
Notes on running CasWAF and the pieces around it: firewall rules, certificates, single sign-on and the parts of a reverse proxy that usually take a weekend.
Putting a company login in front of an internal tool
A reverse proxy can ask for a Casdoor login before a request reaches an application, so admin panels and internal tools get MFA, LDAP and social logins without a line of new code.
Running ModSecurity rules without Nginx
ModSecurity usually arrives as an Nginx module. CasWAF runs the same SecLang rules on Coraza, inside the gateway, with no Nginx underneath. What carries over, what does not, and how to move a ruleset.
Moving an Nginx server block to CasWAF
A server block is a list of decisions: name, upstream, certificate, redirects, limits. Here is what each part turns into in CasWAF, what has no equivalent, and how to cut over without a window of downtime.
Rate limiting that doesn't lock out real users
A rate limit is two numbers and a set of counting rules. Get the counting wrong and one office network or one page load takes the site down for everyone behind it.
The real client IP behind a reverse proxy
IP rules, rate limits and request records all key off the client's address. Once a proxy is in front, the address in the socket belongs to the proxy. How CasWAF works out the real one, and when it refuses to believe the header.
Several gateways, one database
CasWAF has no cluster mode. Any number of machines can run the same gateway against one database, which is the same thing with fewer moving parts. What is shared, what each node keeps to itself, and where it breaks.