corazawaf/coraza
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library observed · 2026-08-28
Health v2 · maintenance only
92/100
- Activity 99
- Release rhythm 78
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: 5
- age_days: 2289
- days_rel: 149
- days_push: 8
- n_releases_24m: 8
Adoption not part of the score
3761 stars · 352 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded
OWASP Coraza is an open-source, enterprise-grade Web Application Firewall (WAF) library written in Go, compatible with ModSecurity SecLang rulesets and 100% compatible with the OWASP Core Rule Set v4. It can be embedded in Go applications or deployed via connectors for Envoy, Istio, Caddy, NGINX, and HAProxy to protect web apps and APIs from attacks like SQL injection and XSS.
Use cases
- protect my web application from SQL injection and XSS attacks
- drop-in replacement for ModSecurity in Go
- run OWASP Core Rule Set with a Go WAF engine
- add a web application firewall to an Envoy or Caddy proxy
- embed WAF protection in a Go HTTP server as a library
- block malicious HTTP requests before they reach my API
When to choose
- you need a high-performance, embeddable WAF in Go with ModSecurity SecLang compatibility
- you want to run OWASP CRS v4 rules without the ModSecurity C engine
- you deploy via Envoy, Istio, Caddy, NGINX, or HAProxy and need WAF integration
When to avoid
- you need a standalone WAF appliance with a management UI out of the box
- you rely on full ModSecurity compatibility including legacy CRS versions or niche features
- your stack is not Go, C++, or WebAssembly and no connector fits your proxy
Facets
library · maturity stable
security http-server middleware plugin-system security web-development backend apis go self-hosted wasm cross-platform waf web-application-firewall modsecurity seclang owasp-crs sql-injection-protection xss-protection envoy caddy reverse-proxy linux docker
4 sources
- readme: https://github.com/corazawaf/coraza · fetched 2026-08-28 · 1c45adbe540c
- homepage: https://www.coraza.io · fetched 2026-08-29 · a22779d41c29
- site_page: https://www.coraza.io/docs/tutorials/introduction · fetched 2026-08-29 · 9ebe9f596647
- site_page: https://www.coraza.io/docs/tutorials/quick-start · fetched 2026-08-29 · 123bbdc83f92
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| corazawaf/coraza | main | 92 |
For agents
markdown · JSON · MCP: product_card(name="corazawaf/coraza")
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem