Chaitin WAF Configuration
Configuration reference for the Chaitin WAF plugin (`chaitin-waf`): the parameters and plugin metadata, each attribute with its type, whether it is required, its default and its accepted values.
Parameters
See plugin common configurations (opens in Apache APISIX docs) for configuration options available to all plugins.
mode — string · optional · default: block · since APISIX 3.13.0 · API7 Gateway 3.8.9
Valid values: off, monitor, or block
Mode to determine how the plugin behaves for matched requests.
In off mode, WAF checks are skipped. In monitor mode, requests with potential threats are logged but not blocked. In block mode, requests with threats are blocked as determined by the WAF service.
match — array[object] · optional · since APISIX 3.5.0 · API7 Gateway 3.8.9
An array of matching rules. The plugin uses these rules to decide whether to perform a WAF check on a request. If the list is empty, all requests are processed.
vars — array[array] · optional · since APISIX 3.5.0 · API7 Gateway 3.8.9
An array of one or more matching conditions in the form of APISIX expressions (opens in Apache APISIX docs) to conditionally execute the plugin.
append_waf_resp_header — boolean · optional · default: true · since APISIX 3.5.0 · API7 Gateway 3.8.9
If true, add response headers X-APISIX-CHAITIN-WAF, X-APISIX-CHAITIN-WAF-TIME, X-APISIX-CHAITIN-WAF-ACTION, and X-APISIX-CHAITIN-WAF-STATUS.
append_waf_debug_header — boolean · optional · default: false · since APISIX 3.5.0 · API7 Gateway 3.8.9
If true, add debugging headers X-APISIX-CHAITIN-WAF-ERROR and X-APISIX-CHAITIN-WAF-SERVER to the response. Effective only when append_waf_resp_header is true.
config — object · optional · since APISIX 3.5.0 · API7 Gateway 3.8.9
Chaitin WAF service configurations. These settings override the corresponding metadata defaults when specified.
connect_timeout — integer · optional · default: 1000 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The connection timeout to the WAF service, in milliseconds.
send_timeout — integer · optional · default: 1000 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The sending timeout for transmitting data to the WAF service, in milliseconds.
read_timeout — integer · optional · default: 1000 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The reading timeout for receiving data from the WAF service, in milliseconds.
req_body_size — integer · optional · default: 1024 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The maximum allowed request body size, in KB.
keepalive_size — integer · optional · default: 256 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The maximum number of idle connections to the WAF detection service that can be maintained concurrently.
keepalive_timeout — integer · optional · default: 60000 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The idle connection timeout for the WAF service, in milliseconds.
real_client_ip — boolean · optional · default: true · since APISIX 3.13.0 · API7 Gateway 3.8.9
If true, use the client IP already resolved by the gateway, including any trusted-proxy or real-IP configuration. If false, use the direct peer address from the connection. The plugin does not read client-supplied forwarded headers directly.
log_resp — boolean · optional · since API7 Gateway 3.9.20
If true, report the response to the WAF detection service after it has been delivered to the client, in addition to the request. The report is advisory and never blocks or modifies the response. Available in API7 Enterprise 3.9.20 and 3.10.7.
resp_body_size — integer · optional · since API7 Gateway 3.9.20
The maximum amount of the response body to report, in KB. Set to 0 to report only the response headers. Effective only when log_resp is true. Available in API7 Enterprise 3.9.20 and 3.10.7.
extra_ignored_content_types — string · optional · since API7 Gateway 3.9.20
A comma-separated list of additional response content types to skip, on top of the built-in ignored list. A response whose content type matches is not reported to the WAF detection service at all, headers included. Effective only when log_resp is true. Available in API7 Enterprise 3.9.20 and 3.10.7.
Plugin Metadata
nodes — array[object] · required · since APISIX 3.5.0 · API7 Gateway 3.8.9
An array of addresses for the Chaitin WAF service.
host — string · required · since APISIX 3.5.0 · API7 Gateway 3.8.9
Address of Chaitin WAF service. Supports IPv4, IPv6, Unix Socket, etc.
port — integer · optional · default: 80 · since APISIX 3.5.0 · API7 Gateway 3.8.9
Port of Chaitin WAF service.
mode — string · optional · default: block · since APISIX 3.13.0 · API7 Gateway 3.8.9
Mode to determine how the plugin behaves for matched requests.
In off mode, WAF checks are skipped. In monitor mode, requests with potential threats are logged but not blocked. In block mode, requests with threats are blocked as determined by the WAF service.
config — object · optional · since APISIX 3.5.0 · API7 Gateway 3.8.9
Chaitin WAF service configurations.
connect_timeout — integer · optional · default: 1000 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The connection timeout to the WAF service, in milliseconds.
send_timeout — integer · optional · default: 1000 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The sending timeout for transmitting data to the WAF service, in milliseconds.
read_timeout — integer · optional · default: 1000 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The reading timeout for receiving data from the WAF service, in milliseconds.
req_body_size — integer · optional · default: 1024 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The maximum allowed request body size, in KB.
keepalive_size — integer · optional · default: 256 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The maximum number of idle connections to the WAF detection service that can be maintained concurrently.
keepalive_timeout — integer · optional · default: 60000 · since APISIX 3.5.0 · API7 Gateway 3.8.9
The idle connection timeout for the WAF service, in milliseconds.
real_client_ip — boolean · optional · default: true · since APISIX 3.13.0 · API7 Gateway 3.8.9
If true, use the client IP already resolved by the gateway, including any trusted-proxy or real-IP configuration. If false, use the direct peer address from the connection. The plugin does not read client-supplied forwarded headers directly.
log_resp — boolean · optional · default: false · since API7 Gateway 3.9.20
If true, report the response to the WAF detection service after it has been delivered to the client, in addition to the request. The report is advisory and never blocks or modifies the response. Available in API7 Enterprise 3.9.20 and 3.10.7.
resp_body_size — integer · optional · default: 4 · since API7 Gateway 3.9.20
The maximum amount of the response body to report, in KB. Set to 0 to report only the response headers. Effective only when log_resp is true. Available in API7 Enterprise 3.9.20 and 3.10.7.
extra_ignored_content_types — string · optional · since API7 Gateway 3.9.20
A comma-separated list of additional response content types to skip, on top of the built-in ignored list. A response whose content type matches is not reported to the WAF detection service at all, headers included. Effective only when log_resp is true. Available in API7 Enterprise 3.9.20 and 3.10.7.