agentzh at gmail.com
Thu Sep 13 21:42:04 UTC 2012
On Thu, Sep 13, 2012 at 8:29 AM, AJ Weber <aweber at comcast.net> wrote:
> Would like to integrate WAF functionality/capability with nginx. Has anyone
> tested the latest version of ModSecurity (2.7.0), which apparently has a
> module for nginx?
My colleague John Graham-Cumming has been working on a compiler that
can compile a good number of ModSecurity rule configurations into Lua
code that can be run atop ngx_lua . We (CloudFlare) may opensource
it at some point.
Some (big) users of mine have been using ngx_lua to implement custom
WAF in production and sent back good results. Some reported better
performance with ngx_lua than both ModSecurity and Naxi, but I've not
confirmed the result myself yet :)
More information about the nginx