Skip to main content

​
WAF Engine

The Aegis WAF engine evaluates every proxied request against a chain of compiled rules. Each proxy host independently runs in off, detect, or enforce mode.

​
WAF Modes

ModeBehavior
OffPure reverse proxy — no WAF evaluation
DetectEvaluate rules and log matches, but allow all traffic through
EnforceEvaluate rules and block matching requests

​
Built-in Capabilities

CapabilityDetails
26 built-in rulesOWASP Top 10 coverage across all major attack categories
Per-host WAF modeoff, detect, enforce per proxy host
Rate limitingToken bucket algorithm per IP or per host with burst allowance
IP blacklistsBlock by IP/CIDR; compiled to net.IPNet for fast matching
IP whitelistsBypass all WAF rules for trusted IPs/CIDRs
CORS enforcementPer-host origin, method, header, credential, and max-age policies; optionally block invalid origins
Input normalizationURL decoding + double-decode detection before rule evaluation
Method restrictionPer-host allowed HTTP methods
Response filteringStrip Server, X-Powered-By, X-AspNet-Version headers
Security header injectionAuto-inject X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
SameSite cookie enforcementForce SameSite=Lax on upstream Set-Cookie headers missing the attribute
Paranoia levelsRules tagged with paranoia level (1-4) for tunable sensitivity
Configurable targetsEach rule targets specific input surfaces: path, query, body, headers, cookies, user-agent
Severity-based auto blockingAutomatically blacklists offending IPs when a blocked match meets the configured minimum severity

​
Detection Categories

The built-in rule library covers the following attack classes:
CategoryRulesExamples
SQL InjectionCore, Extended, Comment BypassUNION SELECT, SLEEP(), BENCHMARK(), stacked queries
Cross-Site ScriptingCore, Event Handlers, SVG/MathML<script>, onerror=, javascript:, SVG/iframe/embed
Server-Side Template InjectionSSTI{{7*7}}, ${T(java.lang.Runtime)}, <%, {%
SSRFCore, Extended127.0.0.1, 169.254.169.254, file://, decimal/octal IPs
Command InjectionCore, PowerShellShell metacharacters, Invoke-Expression
Path TraversalTraversal + Null Bytes../, %2e%2e%2f, double-encoded variants
LDAP InjectionLDAP Filter Manipulation)(, *)(cn=*, filter injection
XPath InjectionXPath Function Abusestring(), count(), contains()
CRLF Header InjectionHTTP Response Splitting%0d%0a, \r\n in header values
Log4ShellJNDI Injection${jndi:ldap://}, obfuscated variants
Spring4ShellJava Runtime Execclass.module.classLoader
DeserializationJava, PHP, Pythonaced0005 (Java magic bytes), O: (PHP), pickle signatures
Scanner DetectionUser-Agent Fingerprintingsqlmap, Nikto, Nmap, Burp Suite, Nuclei, WPScan
Sensitive File ProbingConfig/VCS File Access.env, .git, .htaccess, WEB-INF, web.config
Session FixationSession ID in URLJSESSIONID=, PHPSESSID=, token parameters

​
Auto Blocking by Severity

Aegis can automatically blacklist source IPs when a request is blocked by the WAF and the matched rule severity meets or exceeds a configured threshold. How it works:
  1. The request must be actively blocked by the WAF
  2. Aegis compares the matched rule severity against the configured minimum severity
  3. If the rule severity meets or exceeds that threshold, the source IP is added to that host’s blacklist as a /32 CIDR entry
  4. The proxy runtime is reloaded so the new blacklist entry takes effect immediately

​
Configuration

SettingValue
Setting keywaf.auto_blacklist_min_severity
LocationAdmin UI -> Settings -> Auto-Blacklist Minimum Severity
Defaulthigh
Available values: off, low, medium, high, critical
  • high — auto-blacklist high and critical blocked attacks
  • critical — only auto-blacklist critical blocked attacks
  • off — disable severity-based auto blacklisting entirely
Auto blocking is host-specific. Requests that are only detected or logged (not blocked) do not trigger auto blacklisting.

​
Geolocation

Aegis enriches traffic analytics with city and country geolocation using ipgeolocation.io. Used for:
  • Dashboard Traffic Origins
  • Analytics geographic distribution
  • City and country enrichment on traffic and top-IP views
Setup:
  1. Create an account at ipgeolocation.io
  2. Generate an API key
  3. Open Aegis Settings and set the API Key
Lookups are cached locally in SQLite. Geolocation enrichment is cache-first and does not block the request path.