Chaitin WAF Configuration

Parameters

See plugin common configurations for configuration options available to all plugins.

• mode — string · optional · default: block

  Valid values: off, monitor, or block

  Mode to determine how the plugin behaves for matched requests.

  In off mode, WAF checks are skipped. In monitor mode, requests with potential threats are logged but not blocked. In block mode, requests with threats are blocked as determined by the WAF service.

• match — array[object] · optional

  An array of matching rules. The plugin uses these rules to decide whether to perform a WAF check on a request. If the list is empty, all requests are processed.

  • vars — array[array] · optional

    An array of one or more matching conditions in the form of APISIX expressions to conditionally execute the plugin.

• append_waf_resp_header — boolean · optional · default: true

  If true, add response headers X-APISIX-CHAITIN-WAF, X-APISIX-CHAITIN-WAF-TIME, X-APISIX-CHAITIN-WAF-ACTION, and X-APISIX-CHAITIN-WAF-STATUS.

• append_waf_debug_header — boolean · optional · default: false

  If true, add debugging headers X-APISIX-CHAITIN-WAF-ERROR and X-APISIX-CHAITIN-WAF-SERVER to the response. Effective only when append_waf_resp_header is true.

• config — object · optional

  Chaitin WAF service configurations. These settings override the corresponding metadata defaults when specified.

  • connect_timeout — integer · optional · default: 1000

    The connection timeout to the WAF service, in milliseconds.

  • send_timeout — integer · optional · default: 1000

    The sending timeout for transmitting data to the WAF service, in milliseconds.

  • read_timeout — integer · optional · default: 1000

    The reading timeout for receiving data from the WAF service, in milliseconds.

  • req_body_size — integer · optional · default: 1024

    The maximum allowed request body size, in KB.

  • keepalive_size — integer · optional · default: 256

    The maximum number of idle connections to the WAF detection service that can be maintained concurrently.

  • keepalive_timeout — integer · optional · default: 60000

    The idle connection timeout for the WAF service, in milliseconds.

  • real_client_ip — boolean · optional · default: true

    If true, use the client IP already resolved by the gateway, including any trusted-proxy or real-IP configuration. If false, use the direct peer address from the connection. The plugin does not read client-supplied forwarded headers directly.

  • log_resp — boolean · optional

    If true, report the response to the WAF detection service after it has been delivered to the client, in addition to the request. The report is advisory and never blocks or modifies the response. Available in API7 Enterprise from version 3.9.20.

  • resp_body_size — integer · optional

    The maximum amount of the response body to report, in KB. Set to 0 to report only the response headers. Effective only when log_resp is true. Available in API7 Enterprise from version 3.9.20.

  • extra_ignored_content_types — string · optional

    A comma-separated list of additional response content types to skip, on top of the built-in ignored list. A response whose content type matches is not reported to the WAF detection service at all, headers included. Effective only when log_resp is true. Available in API7 Enterprise from version 3.9.20.

Plugin Metadata

• nodes — array[object] · required

  An array of addresses for the Chaitin WAF service.

  • host — string · required

    Address of Chaitin WAF service. Supports IPv4, IPv6, Unix Socket, etc.

  • port — integer · optional · default: 80

    Port of Chaitin WAF service.

• mode — string · optional · default: block

  Mode to determine how the plugin behaves for matched requests.

  In off mode, WAF checks are skipped. In monitor mode, requests with potential threats are logged but not blocked. In block mode, requests with threats are blocked as determined by the WAF service.

• config — object · optional

  Chaitin WAF service configurations.

  • connect_timeout — integer · optional · default: 1000

    The connection timeout to the WAF service, in milliseconds.

  • send_timeout — integer · optional · default: 1000

    The sending timeout for transmitting data to the WAF service, in milliseconds.

  • read_timeout — integer · optional · default: 1000

    The reading timeout for receiving data from the WAF service, in milliseconds.

  • req_body_size — integer · optional · default: 1024

    The maximum allowed request body size, in KB.

  • keepalive_size — integer · optional · default: 256

    The maximum number of idle connections to the WAF detection service that can be maintained concurrently.

  • keepalive_timeout — integer · optional · default: 60000

    The idle connection timeout for the WAF service, in milliseconds.

  • real_client_ip — boolean · optional · default: true

    If true, use the client IP already resolved by the gateway, including any trusted-proxy or real-IP configuration. If false, use the direct peer address from the connection. The plugin does not read client-supplied forwarded headers directly.

  • log_resp — boolean · optional · default: false

    If true, report the response to the WAF detection service after it has been delivered to the client, in addition to the request. The report is advisory and never blocks or modifies the response. Available in API7 Enterprise from version 3.9.20.

  • resp_body_size — integer · optional · default: 4

    The maximum amount of the response body to report, in KB. Set to 0 to report only the response headers. Effective only when log_resp is true. Available in API7 Enterprise from version 3.9.20.

  • extra_ignored_content_types — string · optional

    A comma-separated list of additional response content types to skip, on top of the built-in ignored list. A response whose content type matches is not reported to the WAF detection service at all, headers included. Effective only when log_resp is true. Available in API7 Enterprise from version 3.9.20.