AI
From AppShield to Coraza: Twenty-Five Years of WAF Evolution
The first web application firewall was AppShield, launched in 1999. It evolved into mod_security, which set standards later codified by the W3C. Core Rule Set became the industry baseline: Azure and most cloud vendors ship it by default. Coraza arrived as an open source project by 2016. The original WAF design targeted HTML content, form signing, geo-blocking, and Layer 7 DoS protection. Those features made sense 20 years ago. Modern microservices and REST APIs demand something different.
Why IBM, Alibaba, and Microsoft Pull from Coraza
Coraza has 30 contributors, 2,000+ GitHub stars, nearly 1,000 commits, and close to 300 resolved issues. IBM, Alibaba, and Microsoft constantly pull from its repositories. Unlike mod_security, whose main users are blogs and small sites, Coraza’s adopters are large enterprises. Six properties drive that: it is a drop-in replacement for mod_security, 100% compatible with Core Rule Set, extensible in three lines of code, up to 15 times faster than average WAFs, usable as a plain library, and community-driven with no corporate feature mandates.
Benchmarking at Scale: 9,000 Requests Per Second
The latest Coraza release ran on a 32-core AWS machine with 64 MB of memory. With all Core Rule Set rules active, it hit 9,000 requests per second, processed 4 million requests in 8 minutes, and supported 10,000 concurrent users. A POST request with nested JSON fields dropped throughput to 6,500 requests per second. That drop is expected for complex payload deserialization. The benchmark code is public, the machine setup is documented, and no special optimizations were applied. Copy the snippet and you have a running Coraza server.
Business Logic and the Limits of Signature Defense
Static signatures catch known attack patterns. They cannot catch business logic abuse. Companies now care more about financial damage, reputation, and data exfiltration than cross-site scripting and SQL injection. Log4Shell was fully blocked by Core Rule Set with no rule update, which shows signatures still have meaningful range. But as applications shifted from HTML pages to minified, compiled JavaScript, the injectable surface moved to APIs. WAFs designed for HTML cannot follow. Protecting the API layer is the gap the industry needs to close.
Protocol Gaps and What Coraza Before Fixes
gRPC, WebSocket, and GraphQL have outpaced open source WAFs. Enterprise commercial products support them; open source has not kept pace. gRPC uses a binary protobuf payload a WAF can deserialize and inspect. WebSocket is harder. A connection can stay open for hours or days. Standard WAF design assumes a transaction with a clear end. WebSocket has none, and its payload format, binary, JSON, or protobuf, is not standardized. Coraza Before, the next major version, targets a pluggable rule language, custom code rules, and integrated rate limiting.
Notable Quotes
Cora runs even 15 times faster than the average web Juan Pablo Tosso · ▶ Watch (6:51)
this has been the year of machine learning for the past 10 years Juan Pablo Tosso · ▶ Watch (18:55)
websockets are not like that Juan Pablo Tosso · ▶ Watch (27:19)
Key Takeaways
- Coraza runs 9,000 requests per second on 32 cores with full Core Rule Set active.
- IBM, Alibaba, and Microsoft use Coraza in production; its main adopters are enterprises, not blogs.
- Signature-based WAFs still block zero-days like Log4Shell but cannot address business logic abuse.
- WebSocket connections can stay open for days, breaking the transaction model that WAFs depend on.
- Coraza Before will support pluggable rule languages, custom code rules, and integrated rate limiting.
About the Speaker(s)
Juan Pablo Tosso is the author and project leader of OWASP Coraza. He has 12 years of experience in cybersecurity, beginning as a penetration tester before shifting to defensive work on the blue team. He works as a solutions architect at Traceable AI and continues developing Coraza as an open source project in his free time.