javajourn

Creating web applications can be quite easy. But creating secure web applications? That’s more complicated.

To enhance security of your web application, you’ll need another security layer, such as a Web Application Firewall (WAF).
A WAF is a server module ,plug-in or similar software layer that examines HTTP traffic coming into your site. Like a software firewall on your desktop, it looks for signs common to attacks, then block suspect connections to keep you safe.
At least ,that’s the plan.

Which WAF is best ,then ?
That’s difficult to say ,but if you’ve not considered this issue before then it’s best to start by simply exploring a few of the leading free products, just to see what’s available.

ModSecurity
(modsecurity.org) is perhaps the best known WAF. Run as an Apache module, it can protect in various ways: detecting and blocking malicious requests; blocking all but known valid requests; monitoring outbound data to detect and block information disclosure(credit card numbers say).But with power comes complexity : sorting out which rules to implement can be a problem.

AQTRONIX WebKnight
(agtronix.com), a WAF for IIS(or any other servers supporting ISAPI filters),takes a rather more straightforward approach, coming with a regular Windows installer package. A GUI makes it easy to tweak your settings, while the filter itself can scan all web traffic – even HTTPS- for brute force attacks, buffer overflows, SQL injection, directory traversal and more.

Naxsi
(code.google.com/p/naxsi) is a simple WAF for Nginx that works something like a spam filter: it detects unusual characters in HTTP requests, every one of these increases the request score, and if this gets too high it will be blocked.

OWASP ESAPI
For developers, the OWASP ESAPI WAF(owasp.org) is perhaps most interesting.
Not a conventional WAF, it’s actually a library of ready-to-use security functions for common tasks, such as validating string input.
It’s free, easy to use ,supports a range of language(Java, .Net, ASP, PHP, JavaScript, Ruby, Perl and more),and is worth a closer look. We’ll revisit it on a future article.