CasWAF vs Nginx
Nginx is a web server and reverse proxy, and it is very good at both. CasWAF is a reverse proxy that also does the firewall job. Putting a WAF in front of Nginx usually means adding ModSecurity or Coraza, a ruleset, something for certificate renewal and something to read when a request is blocked. CasWAF puts those in one program, keeps the settings in a database, and adds a console, request records and single sign-on.
At a glance
| CasWAF | Nginx | |
|---|---|---|
| What it is | Reverse proxy with a firewall, console and SSO | Web server and reverse proxy |
| Firewall | Built in: IP, path, rate and CAPTCHA rules, plus SecLang on Coraza | Not built in; add ModSecurity, Coraza or njs and Lua |
| Configured in | The console; settings in MySQL, shared by every node | Configuration files, then a reload |
| Certificates | Uploaded by hand, or issued and renewed with Let’s Encrypt per domain | Certbot or manual files |
| Console, records, dashboard | Built in, with alerts per site | None; logs go to files or a log stack |
| Single sign-on for your sites | Casdoor login in front of any site, without changing it | None; auth_request modules or an external service |
| License | Apache-2.0 | BSD-2-Clause; Nginx Plus is a paid product |
Where CasWAF is different
A firewall without assembling modules
Blocking by IP range, country, User-Agent or path, rate limiting per address and CAPTCHA are rule types in the console. On Nginx each one means another module, another file and another reload.
Change a site without editing a file
A domain, a certificate or a redirect is a form in the console, and every gateway node picks it up in seconds. There is no configuration to template, copy between servers or validate by hand.
See what came in
Requests are recorded per site, with a dashboard of traffic over time and an alert by email or SMS when a site stops answering. With Nginx that is a separate log pipeline.
Put a login in front of an application
Any site can be put behind a Casdoor login without touching the application, with MFA, LDAP and social logins coming from Casdoor. On Nginx this is auth_request plus your own service.
Several machines, one configuration
Nodes run against one database and all serve the same sites, which is the normal setup rather than a fleet of hand-managed configurations.
Where Nginx is ahead
Throughput and maturity
Nginx handles more traffic per core and has been tuned in production for twenty years. CasWAF is a Go program with a database behind it, and does not claim to match it.
Far more as a web server
Caching, compression, fine control over buffering and timeouts, static file serving at scale and TCP and UDP streams are all Nginx features CasWAF does not have.
Modules and documentation
The module ecosystem and the amount of written material about every corner of Nginx are much larger than anything a young project can offer.
You already run it
If Nginx is working and the firewall is not the problem, staying put is a reasonable answer.
Which to pick
- You need a WAF, a console and SSO without adding modules: CasWAF.
- You serve heavy static traffic or need caching, streams or a module CasWAF does not have: keep Nginx and put CasWAF in front of it, or in front of the applications it serves.
- You manage many sites and want them in one console: CasWAF.
- You are happy editing configuration files and only want raw performance: Nginx.
Related pages
Try CasWAF on one machine
Go, Node.js and MySQL, a Casdoor application for the console, and the gateway starts on port 17000.