| Name | flask-waf JSON |
| Version |
2.0.8
JSON |
| download |
| home_page | https://github.com/ishanoshada/Flask-Waf |
| Summary | Flask-WAF is an advanced Web Application Firewall (WAF) extension for Flask applications. It provides comprehensive protection against various web application threats, enhancing the security of your Flask-based web applications. |
| upload_time | 2024-11-28 19:19:07 |
| maintainer | None |
| docs_url | None |
| author | Ishan Oshada |
| requires_python | None |
| license | None |
| keywords |
|
| VCS |
 |
| bugtrack_url |
|
| requirements |
No requirements were recorded.
|
| Travis-CI |
No Travis.
|
| coveralls test coverage |
No coveralls.
|
## Flask-WAF
Flask-WAF is an advanced Web Application Firewall (WAF) extension for Flask applications. It provides comprehensive protection against various web application threats, enhancing the security of your Flask-based web applications.
## Table of Contents
1. [Features](#features)
2. [Installation](#installation)
3. [Quick Start](#quick-start)
4. [Configuration](#configuration)
5. [Advanced Usage](#advanced-usage)
6. [API Reference](#api-reference)
7. [Contributing](#contributing)
8. [License](#license)
## Features
- Advanced rule engine for detecting and blocking malicious requests
- Session protection to prevent session hijacking and fixation attacks
- Content Security Policy (CSP) implementation
- Threat intelligence integration
- Anomaly detection to identify unusual patterns
- Rate limiting to prevent abuse
- Comprehensive logging
- Customizable security rules and policies
## Installation
You can install Flask-WAF using pip:
```bash
pip install flask-waf
```
Alternatively, you can install from the source:
```shellscript
git clone https://github.com/yourusername/flask-waf.git
cd flask-waf
pip install -e .
```
## Quick Start
Here's a simple example of how to use Flask-WAF:
```python
from flask import Flask
from flask_waf import WAF
app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key' # Required for session handling
waf = WAF(app)
@app.route('/')
def hello_world():
return 'Hello, World!'
if __name__ == '__main__':
app.run(debug=True)
```
This basic setup will apply default WAF protection to your Flask application.
## Configuration
Flask-WAF can be configured using a JSON file or by passing a dictionary to the WAF constructor. Here's an example configuration:
```python
waf_config = {
"max_request_size": 1048576, # 1MB
"allowed_content_types": [
"application/x-www-form-urlencoded",
"application/json",
"multipart/form-data"
],
"max_url_length": 2083,
"max_query_params": 100,
"max_headers": 100,
"required_headers": ["Host", "User-Agent"],
"rate_limit": 100, # requests per minute
"session_protection": True,
"content_security_policy": {
"default-src": ["'self'"],
"script-src": ["'self'", "'unsafe-inline'"],
"style-src": ["'self'", "'unsafe-inline'"],
},
"anomaly_detection": {
"request_threshold": 10,
"time_window": 60
}
}
waf = WAF(app, config=waf_config)
```
You can also load the configuration from a JSON file:
```python
waf = WAF(app, config_file='waf_config.json')
```
## Advanced Usage
### Custom Rules
You can add custom rules to the WAF's rule engine:
```python
from flask_waf import WAF, Rule
waf = WAF(app)
custom_rule = Rule(
name='Custom SQL Injection Check',
pattern=r'UNION\s+SELECT',
locations=['params', 'form', 'json'],
severity='high',
description='Detected potential SQL injection attempt'
)
waf.rule_engine.add_rule(custom_rule)
```
### Threat Intelligence Integration
You can update the threat intelligence module with custom malicious patterns:
```python
waf.threat_intel.add_malicious_pattern(r'malware\.com')
waf.threat_intel.add_malicious_ip_range('192.0.2.0', '192.0.2.255')
```
### Logging
Flask-WAF provides comprehensive logging. You can customize the log file location:
```python
waf.logger.set_log_file('/path/to/waf.log')
```
## API Reference
### WAF Class
The main class for initializing the Web Application Firewall.
```python
class WAF:
def __init__(self, app=None, config=None, config_file=None):
...
def init_app(self, app):
...
def check_request(self):
...
def add_security_headers(self, response):
...
```
### Rule Class
Used for defining custom security rules.
```python
class Rule:
def __init__(self, name, pattern, locations, severity='medium', description=''):
...
def check(self, data):
...
```
### RuleEngine Class
Manages and applies security rules.
```python
class RuleEngine:
def add_rule(self, rule):
...
def remove_rule(self, rule_name):
...
def check_request(self, request):
...
```
For a complete API reference, please refer to the [API documentation](https://flask-waf.readthedocs.io/en/latest/api.html).
## Contributing
We welcome contributions! Please see our [contributing guide](CONTRIBUTING.md) for more details.
## License
Flask-WAF is released under the MIT License. See the [LICENSE](LICENSE) file for more details.
Raw data
{
"_id": null,
"home_page": "https://github.com/ishanoshada/Flask-Waf",
"name": "flask-waf",
"maintainer": null,
"docs_url": null,
"requires_python": null,
"maintainer_email": null,
"keywords": null,
"author": "Ishan Oshada",
"author_email": "ic31908@gmail.com",
"download_url": "https://files.pythonhosted.org/packages/5c/4d/68f38dc82cc036e10ebc43728e9b4c2052cdfd3737c9073a9244474fd9e4/flask_waf-2.0.8.tar.gz",
"platform": null,
"description": "## Flask-WAF\r\n\r\nFlask-WAF is an advanced Web Application Firewall (WAF) extension for Flask applications. It provides comprehensive protection against various web application threats, enhancing the security of your Flask-based web applications.\r\n\r\n## Table of Contents\r\n\r\n1. [Features](#features)\r\n2. [Installation](#installation)\r\n3. [Quick Start](#quick-start)\r\n4. [Configuration](#configuration)\r\n5. [Advanced Usage](#advanced-usage)\r\n6. [API Reference](#api-reference)\r\n7. [Contributing](#contributing)\r\n8. [License](#license)\r\n\r\n## Features\r\n\r\n- Advanced rule engine for detecting and blocking malicious requests\r\n- Session protection to prevent session hijacking and fixation attacks\r\n- Content Security Policy (CSP) implementation\r\n- Threat intelligence integration\r\n- Anomaly detection to identify unusual patterns\r\n- Rate limiting to prevent abuse\r\n- Comprehensive logging\r\n- Customizable security rules and policies\r\n\r\n## Installation\r\n\r\nYou can install Flask-WAF using pip:\r\n\r\n```bash\r\npip install flask-waf\r\n```\r\n\r\nAlternatively, you can install from the source:\r\n\r\n```shellscript\r\ngit clone https://github.com/yourusername/flask-waf.git\r\ncd flask-waf\r\npip install -e .\r\n```\r\n\r\n## Quick Start\r\n\r\nHere's a simple example of how to use Flask-WAF:\r\n\r\n```python\r\nfrom flask import Flask\r\nfrom flask_waf import WAF\r\n\r\napp = Flask(__name__)\r\napp.config['SECRET_KEY'] = 'your-secret-key' # Required for session handling\r\nwaf = WAF(app)\r\n\r\n@app.route('/')\r\ndef hello_world():\r\n return 'Hello, World!'\r\n\r\nif __name__ == '__main__':\r\n app.run(debug=True)\r\n```\r\n\r\nThis basic setup will apply default WAF protection to your Flask application.\r\n\r\n## Configuration\r\n\r\nFlask-WAF can be configured using a JSON file or by passing a dictionary to the WAF constructor. Here's an example configuration:\r\n\r\n```python\r\nwaf_config = {\r\n \"max_request_size\": 1048576, # 1MB\r\n \"allowed_content_types\": [\r\n \"application/x-www-form-urlencoded\",\r\n \"application/json\",\r\n \"multipart/form-data\"\r\n ],\r\n \"max_url_length\": 2083,\r\n \"max_query_params\": 100,\r\n \"max_headers\": 100,\r\n \"required_headers\": [\"Host\", \"User-Agent\"],\r\n \"rate_limit\": 100, # requests per minute\r\n \"session_protection\": True,\r\n \"content_security_policy\": {\r\n \"default-src\": [\"'self'\"],\r\n \"script-src\": [\"'self'\", \"'unsafe-inline'\"],\r\n \"style-src\": [\"'self'\", \"'unsafe-inline'\"],\r\n },\r\n \"anomaly_detection\": {\r\n \"request_threshold\": 10,\r\n \"time_window\": 60\r\n }\r\n}\r\n\r\nwaf = WAF(app, config=waf_config)\r\n```\r\n\r\nYou can also load the configuration from a JSON file:\r\n\r\n```python\r\nwaf = WAF(app, config_file='waf_config.json')\r\n```\r\n\r\n## Advanced Usage\r\n\r\n### Custom Rules\r\n\r\nYou can add custom rules to the WAF's rule engine:\r\n\r\n```python\r\nfrom flask_waf import WAF, Rule\r\n\r\nwaf = WAF(app)\r\n\r\ncustom_rule = Rule(\r\n name='Custom SQL Injection Check',\r\n pattern=r'UNION\\s+SELECT',\r\n locations=['params', 'form', 'json'],\r\n severity='high',\r\n description='Detected potential SQL injection attempt'\r\n)\r\n\r\nwaf.rule_engine.add_rule(custom_rule)\r\n```\r\n\r\n### Threat Intelligence Integration\r\n\r\nYou can update the threat intelligence module with custom malicious patterns:\r\n\r\n```python\r\nwaf.threat_intel.add_malicious_pattern(r'malware\\.com')\r\nwaf.threat_intel.add_malicious_ip_range('192.0.2.0', '192.0.2.255')\r\n```\r\n\r\n### Logging\r\n\r\nFlask-WAF provides comprehensive logging. You can customize the log file location:\r\n\r\n```python\r\nwaf.logger.set_log_file('/path/to/waf.log')\r\n```\r\n\r\n## API Reference\r\n\r\n### WAF Class\r\n\r\nThe main class for initializing the Web Application Firewall.\r\n\r\n```python\r\nclass WAF:\r\n def __init__(self, app=None, config=None, config_file=None):\r\n ...\r\n\r\n def init_app(self, app):\r\n ...\r\n\r\n def check_request(self):\r\n ...\r\n\r\n def add_security_headers(self, response):\r\n ...\r\n```\r\n\r\n### Rule Class\r\n\r\nUsed for defining custom security rules.\r\n\r\n```python\r\nclass Rule:\r\n def __init__(self, name, pattern, locations, severity='medium', description=''):\r\n ...\r\n\r\n def check(self, data):\r\n ...\r\n```\r\n\r\n### RuleEngine Class\r\n\r\nManages and applies security rules.\r\n\r\n```python\r\nclass RuleEngine:\r\n def add_rule(self, rule):\r\n ...\r\n\r\n def remove_rule(self, rule_name):\r\n ...\r\n\r\n def check_request(self, request):\r\n ...\r\n```\r\n\r\nFor a complete API reference, please refer to the [API documentation](https://flask-waf.readthedocs.io/en/latest/api.html).\r\n\r\n## Contributing\r\n\r\nWe welcome contributions! Please see our [contributing guide](CONTRIBUTING.md) for more details.\r\n\r\n## License\r\n\r\nFlask-WAF is released under the MIT License. See the [LICENSE](LICENSE) file for more details.\r\n\r\n",
"bugtrack_url": null,
"license": null,
"summary": "Flask-WAF is an advanced Web Application Firewall (WAF) extension for Flask applications. It provides comprehensive protection against various web application threats, enhancing the security of your Flask-based web applications.",
"version": "2.0.8",
"project_urls": {
"Homepage": "https://github.com/ishanoshada/Flask-Waf"
},
"split_keywords": [],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "5c4d68f38dc82cc036e10ebc43728e9b4c2052cdfd3737c9073a9244474fd9e4",
"md5": "db786e8052806e899b7b934afaef8817",
"sha256": "47f7803d4b3fe8180b6d20df0b9c5562340322222890009eec327ec00b90ec6f"
},
"downloads": -1,
"filename": "flask_waf-2.0.8.tar.gz",
"has_sig": false,
"md5_digest": "db786e8052806e899b7b934afaef8817",
"packagetype": "sdist",
"python_version": "source",
"requires_python": null,
"size": 9847,
"upload_time": "2024-11-28T19:19:07",
"upload_time_iso_8601": "2024-11-28T19:19:07.661222Z",
"url": "https://files.pythonhosted.org/packages/5c/4d/68f38dc82cc036e10ebc43728e9b4c2052cdfd3737c9073a9244474fd9e4/flask_waf-2.0.8.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-11-28 19:19:07",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "ishanoshada",
"github_project": "Flask-Waf",
"travis_ci": false,
"coveralls": false,
"github_actions": false,
"lcname": "flask-waf"
}
