-
-
Notifications
You must be signed in to change notification settings - Fork 212
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Gin Framework doesn't work from Coraza V3 #886
Comments
Hi, I don't know much about Gin, Edit: it is not 😕 |
Unfortunately frameworks like Gin and others define their own handler / middleware interfaces and don't use We currently have http middleware with this private method for handling an https://github.com/corazawaf/coraza/blob/main/http/middleware.go#L26 It could be reasonable to expose that for processing a request, however the bigger challenge is processing a response, in that middleware we also wrap the response writer to be able to process it, which is significantly more complex https://github.com/corazawaf/coraza/blob/main/http/interceptor.go Since Gin has a custom response type, we couldn't provide a drop-in helper for that in the What does come to mind is exposing something like this
Then in gin middleware would still need to have its own custom |
Wanted to use Coraza with Echo by adapting the Gin example. Stumbled across the same problem with missing request handle method. On that topic of integration: I'm new to the idea of WAFs, I understand why a WAF scans the Request input, why does it need to parse the response of my app? |
It might be possible to prevent data leakages matching common patterns like common errors and warnings that are printed in the response when the database/application is not behaving as intended. So, even if for any reason the malicious payload went through, there is another enforcement point where it is possible to drop the response and effectively deny the attack. In order to see some rules dealing with the response, you may go through the rule files starting with |
Thanks that helped! Now I hope even more that Coraza will expose an API so Gin/Echo/Fiber users on Go can use it in their applications as a middleware. |
Hi you've removed the tx.ProcessRequest, which directly took the Request object from net/http as a parameter, which means that your library isn't adapted to gin. Would it be possible to add the possibility of adding a custom Request in order to remedy this problem?
The text was updated successfully, but these errors were encountered: