OWASP Coraza WAF

What OWASP Coraza WAF is

OWASP Coraza WAF is a free, open-source firewall for web applications and APIs. It supports ModSecurity SecLang rulesets and is described as fully compatible with the OWASP Core Rule Set. The rule set covers attacks such as SQL injection, cross-site scripting, code injection, HTTPoxy, Shellshock, and scanner or bot activity. Coraza can run as a sidecar, proxy, or library in Go, C++, and WebAssembly. Official connectors are listed for NGINX, Envoy, Caddy, Apache APISIX, proxy-wasm, HAProxy, Traefik, and libcoraza. Extensions can use audit loggers, persistence engines, operators, actions, and plugins; examples include GeoIP support and a package embedding the Core Rule Set with recommended configuration. The Quick Start requires Go 1.24 or later. Coraza supports API, Linux, macOS, and self-hosted use. Its v3 documentation notes that persistent collections such as IP, SESSION, and RESOURCE are not currently supported. Coraza Playground provides a sandbox web interface for testing rules, and the documentation points users to GitHub Discussions and the OWASP Slack community.

Who it suits

Coraza suits teams protecting APIs or web applications that want an open-source, self-hosted firewall and compatibility with ModSecurity rulesets. It may fit deployments using one of its listed connectors or runtimes.

Limits

The free Open source plan is listed as free. In Coraza v3, persistent collections such as IP, SESSION and RESOURCE are currently unsupported.

Getting started

1. Visit https://www.coraza.io/ and review the documentation
2. Confirm that Go 1.24 or later is available if following the Quick Start
3. Choose a deployment as a sidecar, proxy or library in Go, C++ or WebAssembly
4. Select an official connector for your environment, if applicable
5. Use Coraza Playground to test rules in its sandbox web interface

Verdict

Coraza offers several deployment forms, a broad connector list, and Core Rule Set compatibility for API and web application protection. Teams needing persistent collections such as IP, SESSION, or RESOURCE should account for their current lack of support in v3.