How do I integrate teler-waf with the Gin framework?

Since teler-waf uses a standard net/http.Handler, you can wrap Gin's engine with it. Create a teler instance and use its handler as middleware in Gin's routing—check the examples directory for specific code.

teler-waf vs Cloudflare WAF for Go apps?

teler-waf is self-hosted and customizable within your Go application, ideal for internal or on-premise use. Cloudflare WAF is cloud-based with broader DDoS protection but less control over rules. Choose based on hosting needs and customization.

Does teler-waf protect against DDoS attacks?

No, teler-waf focuses on application-layer threats like XSS and SQL injection, not volumetric DDoS attacks. You'll need additional infrastructure or services for network-level protection.

How to create custom rules for specific attack patterns?

Use the Customs option with regex patterns or DSL expressions in the teler.Options struct. The README provides examples, and you can test rules in the teler WAF playground for validation.

What is the memory impact with the InMemory option?

Enabling InMemory loads threat datasets into RAM, which improves speed but increases memory usage based on dataset size. It's useful for distroless containers but trade-offs resource consumption.

Can teler-waf be used in Kubernetes deployments?

Yes, it can be deployed as a sidecar or integrated into Go microservices in Kubernetes. Ensure gcc is available in the container image for compilation, and consider resource limits due to performance overhead.

Open-Awesome

teler-waf

Apache-2.0Gov1.0.0

A Go HTTP middleware that protects web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, and brute force attacks.

Visit Website GitHub

404 stars33 forks0 contributors

What is teler-waf?

teler-waf is a Go HTTP middleware that integrates intrusion detection capabilities to protect web applications from common security threats. It analyzes incoming requests against known attack patterns, bad actors, and vulnerabilities, blocking malicious traffic before it reaches the application. The middleware is designed to be easily added to existing Go web servers with minimal configuration.

Target Audience

Go developers building web applications who need a lightweight, configurable security layer to defend against OWASP Top 10 threats, malicious bots, and known exploits without relying on external WAF services.

Value Proposition

Developers choose teler-waf for its seamless integration with Go applications, daily updated threat datasets, and extensive customization options including custom rules and whitelists. It provides enterprise-grade security as a middleware, reducing the need for external WAF solutions.

Overview

teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.

Use Cases

Best For

Adding a security layer to Go-based REST APIs or web services
Protecting internal applications from OWASP Top 10 threats like XSS and SQL injection
Blocking malicious bots, crawlers, and known bad IP addresses
Implementing custom security rules for application-specific threats
Self-hosting security for applications where cloud WAFs are not feasible
Integrating intrusion detection with existing monitoring tools like Falco Sidekick or Wazuh

Not Ideal For

High-traffic applications where every microsecond of latency is critical
Teams needing a fully managed, cloud-based WAF with automatic scaling and DDoS protection
Commercial hosted services or SaaS products requiring permissive open-source licensing
Projects without dedicated security expertise to configure complex custom rules

Pros & Cons

Pros

Comprehensive Threat Detection

Covers a wide range of threats including OWASP Top 10 attacks, CVEs, bad IPs, and malicious crawlers using daily updated datasets from teler-resources.

Highly Customizable Rules

Allows creation of custom security rules via regex patterns or a DSL, enabling tailored protection for application-specific logic and threats.

Easy Go Framework Integration

Provides a standard net/http.Handler interface, making it simple to add as middleware to most Go web frameworks like Gin or Echo without major refactoring.

Monitoring Tool Integration

Supports sending alerts to Falco Sidekick and logs to Wazuh, enhancing security monitoring and incident response capabilities.

Cons

Performance Overhead

Adds latency per request (benchmarked at thousands of nanoseconds), which can accumulate and slow down high-traffic applications, as admitted in the limitations section.

Steep Configuration Learning Curve

Setting up custom rules, DSL expressions, and whitelists requires advanced security knowledge, making it challenging for developers without expertise.

Restrictive Licensing for Commercial Use

Under the ELv2 license, it cannot be used for cloud, hosted, or managed services without a commercial license, limiting its applicability for many business models.

Frequently Asked Questions

Related Projects

age

A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

Stars22,979

Forks656

Last commit4 months ago

lego

Let's Encrypt/ACME client and library written in Go

Stars9,760

Forks1,159

Last commit3 days ago

CertMagic

Automatic HTTPS for any Go program: fully-managed TLS certificate issuance and renewal

Stars5,587

Forks345

Last commit7 days ago

Cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

Stars5,130

Forks628