OWASP CRS 4.x
Full request inspection (headers, body, URI, cookies, query parameters) with anomaly scoring and four paranoia levels.
Secured by OVHcloud WAF (OWAF)
Capabilities protecting this site
Everything below is what OWAF can enforce on the path to this origin. Policies are managed in the Admin UI — not in the nginx files of this container.
Three operating modes
Blocking (403), Detection (log only), and Disabled — switch without touching this app.
Custom rules
Up to 500 user-defined rules per instance: targets, operators, transformations, severity, and per-rule actions.
Rate-limit by client
Cap requests per IP, user, or endpoint to protect APIs and sensitive forms from abuse.
Bot traffic control
Separate legitimate bots (search engines, partners) from scrapers and vulnerability scanners.
Live stats dashboard
Request counters, block/pass rates, active connections, and category breakdowns refreshing every 15 seconds.
Use cases OWAF targets
From the product roadmap toward General Availability — already relevant to how this demo is secured.
| Use case | What OWAF does |
|---|---|
| Filter malicious traffic | Block SQLi, XSS, unauthorized access, and known exploit patterns before origin |
| Prevent account takeover | Detect credential stuffing and brute-force on login surfaces |
| Emergency virtual patching | Push a rule for a new CVE without waiting for an application release |
| Compliance evidence | Exportable audit logs for PCI-DSS, ISO 27001, NIS2, or DORA discussions |
| Header / CORS control | Set, remove, move, or copy headers; built-in CORS and OPTIONS passthrough |
Built-in vs custom
Out of the box you get OWASP CRS coverage for SQLi, XSS, RCE, LFI, SSTI, protocol violations, scanner detection, and more. Built-in rules cannot be deleted, but you can enable/disable them and override action or paranoia level.
Client (HTTPS)
→ OVHcloud WAF ingress (TLS terminate + CRS)
→ allow → proxy to origin (this nginx /var/www/waf)
→ deny → 403 Forbidden (origin never sees it)
Admin UI today
Configure every aspect of the WAF from the Admin UI. Public API and Terraform provider are on the roadmap before GA.
Public Cloud integration
Beta/GA aim for closer integration with Public Cloud products (instances, load balancers, and more).