Week 10 Mini Project: Production WAF Middleware
Feature Checklist
- Normalization pipeline (URL → HTML → SQL comments → whitespace → lowercase)
- SQLi detection (keyword + tautology + comment + quote balance)
- XSS detection (tags + events + JS URI)
- Path traversal (all encoded forms)
- Command injection
- SSRF detection
- Body inspection (JSON + form, up to 1MB)
- Scoring model (per-rule + per-category thresholds)
- Exception lists (trusted CIDRs, exempt paths)
- Detection mode vs blocking mode
- Audit log: rule ID, matched value (normalized), score, action
- Hot-reload config every 30s (no restart needed)
- Response: 403 with request ID only (no rule details leaked)
Test the WAF
# Build and start
go run . &
# Should block (SQLi):
curl "http://localhost:8080/search?q=' UNION SELECT * FROM users--"
# Response: {"error":"forbidden","request_id":"abc123"}
# Should block (XSS):
curl "http://localhost:8080/comment?text=<script>alert(1)</script>"
# Response: {"error":"forbidden","request_id":"def456"}
# Should block (path traversal):
curl "http://localhost:8080/files?path=../../../../etc/passwd"
# Should allow (legitimate):
curl "http://localhost:8080/search?q=John+O'Brien+SELECT+all+products"
# Response: 200 OK (normalized input doesn't hit threshold)
# Switch to detection mode (hot-reload):
sed -i 's/"blocking"/"detection"/' waf-config.json
sleep 35 # wait for reload
# Now malicious requests are logged but not blocked
Engineer Takeaway
AWS WAF costs $5/month per rule and $0.60/million requests. Cloudflare WAF starts at $20/month. You've now built the core algorithms that power both. You can now tune a WAF instead of fighting it: write precise rule exceptions ("SQLI-001 triggers on O'Brien in search because of the apostrophe"), and reason about the trade-off between false positives and false negatives.