OWASP Coraza Web Application Firewall
OWASP Coraza is a golang enterprise-grade Web Application Firewall framework that supports Modsecurity’s seclang language and is 100% compatible with OWASP Core Ruleset.
Enrich your web application’s security with powerful rules that comprehensively enforce good cybersecurity behavior.
OWASP Coraza can be imported as a library or used with one of our connectors like coraza-server (GRPC and SPOA), coraza-caddy (web server, reverse proxy), docker (using connector).
About OWASP Coraza Web Application Firewall
Try OWASP Coraza
Try OWASP Coraza using https://coreruleset.org/docs/development/sandbox/ or the Coraza Playground.
curl -H "x-format-output: txt-matched-rules" \
-H "x-backend: coraza-caddy" \
"https://sandbox.coreruleset.org/?search="
Take control of your applications
Control your requests and response before processing by your server or your customer’s browser by submitting the content to our 4 “phase processors.”
Parse multiple content types, like XML, JSON, Multipart, and urlencoded, and don’t miss anything. Coraza can transform all of this into easily manageable variables.
Extend OWASP Coraza to achieve anything; our plugin framework allows you to extend any capability, like operators, actions, directives, body processors, and audit engines.
Don’t miss anything; log everything you need in order to achieve compliance and complete visibility of your applications.
Documentation
We have extensive documentation on integration, directives supported and additional usage patterns.
Licensing
OWASP Coraza Web Application Firewall is free to use. It is licensed under the Apache Software License version 2 (ASLv2), so you can copy, distribute and transmit the work, and you can adapt it and use it commercially. Still, all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.
Project Resources
Project Information
Production Project
Classification
WAF
Language
Go
License
Apache 2.0
Latest Version
3.7.0
Contributors
57
GitHub Stars
3800
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.