📦⚡️ CasWAF

An open-source Web Application Firewall (WAF) software developed by Go and React.

Online demo

• Read-only site: https://door.caswaf.com (any modification operation will fail)
• Writable site: https://demo.caswaf.com (original data will be restored for every 5 minutes)

Documentation

https://caswaf.org

Architecture

CasWAF contains 2 parts:

Name	Description	Language	Source code
Frontend	Web frontend UI for CasWAF	Javascript + React	https://github.com/casbin/caswaf/tree/master/web
Backend	RESTful API backend for CAsWAF	Golang + Beego + MySQL	https://github.com/casbin/caswaf

Installation

CasWAF uses Casdoor to manage members. So you need to create an organization and an application for CasWAF in a Casdoor instance.

Deployment Options

• Kubernetes Deployment: Deploy CasWAF on Kubernetes with complete manifests and guide
• Docker Compose: Use the provided docker-compose.yml for quick local setup
• Manual Installation: Build and run from source

Runtime Configuration (Recommended)

You can configure CasWAF to use your own Casdoor instance without rebuilding the Docker image by mounting a custom config.js file:

# Create config.custom.js with your Casdoor settings
docker run -d -p 17000:17000 \
  -v $(pwd)/config.custom.js:/web/build/config.js:ro \
  -v $(pwd)/conf/app.conf:/conf/app.conf:ro \
  casbin/caswaf:latest

Example config.custom.js:

window.appConfig = {
  serverUrl: "https://your-casdoor.com",
  clientId: "your-client-id",
  appName: "caswaf",
  organizationName: "your-org",
  redirectPath: "/callback",
};

Necessary configuration

Get the code

go get github.com/casdoor/casdoor
go get github.com/casbin/caswaf

or

git clone https://github.com/casdoor/casdoor
git clone https://github.com/casbin/caswaf

Setup database

CasWAF will store its users, nodes and topics information in a MySQL database named: caswaf, will create it if not existed. The DB connection string can be specified at: https://github.com/casbin/caswaf/blob/master/conf/app.conf

dataSourceName = root:123@tcp(localhost:3306)/

CasWAF uses XORM to connect to DB, so all DBs supported by XORM can also be used.

Configure Casdoor

After creating an organization and an application for CasWAF in a Casdoor, you need to update clientID, clientSecret, casdoorOrganization and casdoorApplication in app.conf.

Run CasWAF

• Configure and run CasWAF by yourself. If you want to learn more about caswaf.
• Open browser: http://localhost:16001/

Optional configuration

Setup your WAF to enable some third-party login platform

CasWAF uses Casdoor to manage members. If you want to log in with oauth, you should see casdoor oauth configuration.

OSS, Mail, and SMS services

CasWAF uses Casdoor to upload files to cloud storage, send Emails and send SMSs. See Casdoor for more details.

Contribute

For CasWAF, if you have any questions, you can open Issues, or you can also directly start Pull Requests(but we recommend opening issues first to communicate with the community).

License

Apache-2.0