- Home
- Web Security Software
- OWASP Coraza WAF
OWASP Coraza WAF
What it is
OWASP Coraza WAF is a free, open-source web application firewall for APIs and web applications. It accepts ModSecurity SecLang rulesets and is compatible with the OWASP Core Rule Set, whose protections cover threats such as SQL injection, cross-site scripting, code injection, HTTPoxy, Shellshock, and scanner or bot activity. Coraza can be deployed as a sidecar or proxy, or used as a library in Go, C++, and WebAssembly. Official connectors are listed for NGINX, Envoy, Caddy, Apache APISIX, proxy-wasm, HAProxy, Traefik, and libcoraza. Extensions include audit loggers, persistence engines, operators, actions, and plugins; examples include GeoIP support and a package containing the Core Rule Set with recommended Coraza configuration. The Quick Start requires Go 1.24 or later. Coraza supports API, Linux, macOS, and self-hosted use. Its v3 documentation notes that persistent collections such as IP, SESSION, and RESOURCE are not yet supported. Coraza Playground offers a sandbox web interface for testing rules.
For and against
For
- Free, open-source software.
- Compatible with the OWASP Core Rule Set.
- Deployment options include sidecar, proxy, and library.
- Official connectors cover several proxy platforms.
- Sandbox interface supports rule testing.
Against
- Requires Go 1.24 or later for Quick Start.
- Persistent collections are not supported in v3.
The verdict
Coraza combines established rule compatibility with multiple deployment and integration paths. Check the Go requirement and v3 persistent-collection limitation against your setup before adopting it.
Who it suits
Coraza suits teams building API or web application defenses who want to deploy a firewall in a self-hosted environment or alongside existing proxy infrastructure. It may also fit developers looking for rule testing and extension options.
Plans and prices
Open source
Apache-2.0 connectors · self-hosted deployment
Read 4 Oct 2026 · coraza.io
On the record
- Deployment
- The product page says Coraza can run as a sidecar, proxy, or library in Go, C++, and WebAssembly.coraza.io · read 4 Oct 2026
- Extensibility
- Coraza’s documentation describes extensions through audit loggers, persistence engines, operators, actions, and plugins.coraza.io · read 4 Oct 2026
- Integrations
- Official connectors are listed for NGINX, Envoy, Caddy, Apache APISIX, proxy-wasm, HAProxy, Traefik, and libcoraza.coraza.io · read 4 Oct 2026
- Limit
- The internals documentation says persistent collections such as IP, SESSION, and RESOURCE are currently not supported in Coraza v3.coraza.io · read 4 Oct 2026
- Plugin examples
- Official plugins include GeoIP support and a package that embeds the OWASP Core Rule Set and recommended Coraza configuration.coraza.io · read 4 Oct 2026
- Purpose
- Coraza is an open-source Web Application Firewall for APIs and web applications.coraza.io · read 4 Oct 2026
- Rule compatibility
- Coraza supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set.coraza.io · read 4 Oct 2026
- Runtime requirement
- The Quick Start page lists Go 1.24+ as a requirement.coraza.io · read 4 Oct 2026
- Security testing
- The docs provide Coraza Playground as a sandbox web interface for testing rules.coraza.io · read 4 Oct 2026
- Support and community
- The documentation points users to GitHub Discussions and the OWASP Slack community (#coraza).coraza.io · read 4 Oct 2026
- Threat coverage
- The documentation says OWASP CRS protects against attacks including SQL injection, cross-site scripting, code injection, HTTPoxy, Shellshock, and scanner or bot activity.coraza.io · read 4 Oct 2026
