Thom-x / traefik-modsecurity-plugin

Traefik plugin to proxy requests to owasp/modsecurity-crs:apache container

Traefik Modsecurity Plugin

Traefik plugin to proxy requests to owasp/modsecurity-crs:apache

• Traefik Modsecurity Plugin
  • Demo
  • Usage (docker-compose.yml)
  • How it works
  • Local development (docker-compose.local.yml)

Demo

Demo with WAF intercepting relative access in query param.

Usage (docker-compose.yml)

See docker-compose.yml

1. docker-compose up
2. Go to http://localhost:8000/website, the request is received without warnings
3. Go to http://localhost:8000/website?test=../etc, the request is intercepted and returned with 403 Forbidden by owasp/modsecurity

How it works

This is a very simple plugin that proxies the query to the owasp/modsecurity apache container.

The plugin checks that the response from the waf container hasn't an http code > 400 before forwarding the request to the real service.

If it is > 400, then the error page is returned instead.

The dummy service is created so the waf container forward the request to a service and respond with 200 OK all the time.

Local development (docker-compose.local.yml)

See docker-compose.local.yml

docker-compose -f docker-compose.local.yml up to load the local plugin