CasWAF vs SafeLine
SafeLine and CasWAF both sit in front of your web applications and decide which requests reach them. SafeLine is a WAF first: its own detection engine, a console built around reports, and a free edition that stops at 10 applications. CasWAF is a reverse proxy first: sites, certificates, redirects and login protection are part of it, the firewall is one of its rule types, and no feature is held back for a paid edition.
At a glance
| CasWAF | SafeLine | |
|---|---|---|
| License | Apache-2.0, no paid edition | GPL-3.0 for the community edition; paid Lite, Pro and Ultimate |
| What it is | Reverse proxy, firewall and console in one Go program | A WAF that sits as a reverse proxy in front of applications |
| How it runs | One binary on Linux or Windows, next to MySQL | Docker Compose on a Linux host |
| Configured in | The console; settings in MySQL, shared by every node | The web console |
| Attack detection | IP, User-Agent, path and rate rules; CAPTCHA; ModSecurity SecLang rules on Coraza | Its own semantic analysis engine, plus rules |
| HTTPS certificates | Uploaded by hand, or issued and renewed with Let’s Encrypt per domain | Uploaded in the console |
| Console login | Casdoor: MFA, LDAP, SAML and social logins | Local accounts |
| Editions | One, Apache-2.0 | Free for up to 10 applications, then $10 to $100 a month |
Where CasWAF is different
Everything in one program
The gateway, the console and the rules are a single Go program. There is no Nginx, no Lua and no separate detection service to keep in step, and the same binary runs on Windows as well as Linux.
Settings in a database, not in files
Sites, certificates and rules live in MySQL, and every gateway node reads the same rows. A site added in the console reaches the other nodes within seconds, with nothing to template, copy or reload.
Single sign-on belongs to the product
The console signs in through Casdoor, so MFA, LDAP, SAML and social logins are already there. The same login can be put in front of any site without changing the application.
Apache-2.0 with no cap
There is no application limit and no paid tier to grow into. The license also asks less of you than the GPL if you modify the gateway and let others use it over a network.
Records, a dashboard and alerts
Every request is recorded per site, with a dashboard of traffic over time and an email or SMS when a site stops answering, rather than a firewall console only.
Where SafeLine is ahead
Detection is the product
SafeLine ships a semantic analysis engine tuned to catch attacks without a hand-written ruleset. CasWAF gives you rule types and a ModSecurity engine; it does not bundle a detection engine of its own or the OWASP Core Rule Set.
HTML and JavaScript encryption
SafeLine can re-encrypt a page on every visit so that scrapers and automated tools cannot read the markup directly. CasWAF has nothing like it.
Bots and floods have their own settings
Anti-bot challenges, a password challenge for a whole site and HTTP flood protection are first-class features there. CasWAF covers the same ground with CAPTCHA and rate rules, which take more thought to tune.
A much larger community
SafeLine has over 23,000 stars, packages for Kubernetes ingress and Kong, and documentation in Chinese as well as English. Expect more ready-made answers when something goes wrong.
Which to pick
- You want the strongest attack detection with the least tuning: SafeLine.
- You run many sites across several servers and want one console with single sign-on: CasWAF.
- You need more than 10 applications without a subscription: CasWAF.
- You already use Casdoor, or want internal tools behind a company login without changing them: CasWAF.
Related pages
Try CasWAF on one machine
Go, Node.js and MySQL, a Casdoor application for the console, and the gateway starts on port 17000.