PHPackages gggeek/yet-another-waf-core - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. gggeek/yet-another-waf-core ActiveLibrary[Security](/categories/security) gggeek/yet-another-waf-core =========================== A php library for building web api firewalls 03PHPCI passing Since Jul 10Pushed 1w agoCompare [ Source](https://github.com/gggeek/yet-another-waf-core)[ Packagist](https://packagist.org/packages/gggeek/yet-another-waf-core)[ RSS](/packages/gggeek-yet-another-waf-core/feed)WikiDiscussions main Synced 1w ago READMEChangelogDependenciesVersions (1)Used By (0) Yet Another Web API Firewall - core =================================== [](#yet-another-web-api-firewall---core) A php library for building Web API Firewalls - and other assorted http proxies. Primary finished-product targets are forward proxies for filtering the requests and responses of calls to HTTP APIs to only let through what you want to expose. Example use-cases: - reducing the surface of an API, eg. only allowing READ requests or access to specific URLs - removing sensitive data from an API responses - adding/modifying/removing http headers - tracing of requests and responses - rate limiting (not implemented, but should be implementable with existing components from other packages) - caching (not implemented, but should be implementable with existing components from other packages) Work In Progress ---------------- [](#work-in-progress) ### Working [](#working) - Support for Listening on http and on unix sockets - Matching requests and responses based on htp headers, request/response body and most other HTTP fields - End-to-end testing of all implemented features using Apache, FrankenPHP, Nginx: locally via a container-based test environment and Continuous Integration on every push to GitHub ### In scope (to be implemented) [](#in-scope-to-be-implemented) Main missing features: - Matching request/response bodies using jsonpath/css/xpath expressions - Filtering (modification of requests/responses) - "restart the processing chain" as possible action for matching rules - HTTPS support - Documentation See the [Roadmap](Roadmap.md) for a detailed list of features not yet implemented. ### Out of scope [](#out-of-scope) Not in scope (yet?): - a GUI - dispatching requests to different upstream backends based on conditions - filtering request/response bodies other than Json - feature parity with Varnish or performance parity with HAProxy - using async requests to connect to upstream servers - implementing rate-limiting, caching with own code (we should allow usage of PSR compliant external code for that) Requirements: ------------- [](#requirements) PHP 8.2 and up, with extension: ctype, json and zlib (curl extension recommended). A webserver to run it. If you want to have the proxy listening on a unix socket instead of an http port, choose an http server which can do that: as of June 2026 Nginx and FrankenPHP can, while Apache can't. Either the `symfony/http-client` or `guzzlehttp/guzzle` php package. The php `curl` extension is recommended, as it is required for most of the complex http stuff when making requests to the upstream server. Installation ------------ [](#installation) Via Composer: `composer require gggeek/yet-another-waf-core:dev-main` Then install either `symfony/http-client` or `guzzlehttp/guzzle`. Usage ----- [](#usage) More examples will come... For the moment, see projects and as examples. Or take a look at the Proxy used for the unit testing suite in `./tests/public` Design principles ----------------- [](#design-principles) 1. Security first. No requests are allowed by default, everything has to be whitelisted. 2. Ease of use. Error messages should be clear and rather verbose than cryptic. Logging facilities should be extensive. Ambiguous configuration should be rejected. 3. Flexibility. The proxies should be easy to configure for common scenarios and extend to achieve uncommon ones. A Docker image shall be provided to get started running a "whitelabel" Firewall with no fuss. 4. Stability. No API breackage allowed after version 1.0 is released. Strict adherence to semantic versioning. 5. Performance. Maximum speed of execution and minimum cpu usage / memory usage are *important*. But not the main concern: safety, robustness and flexibility come first. 6. Versatility. Proxies and Firewalls built on this library should work the same regardless of the webserver used to run PHP, be it Apache, Nginx, FrankenPHP or something else. The library should interoperate seamlessly with 3rd-party components readily available in the php ecosystem. Which translates into: - PHP 8.2 and up - strict typing everywhere - using DI patterns as much as possible - using the PSR-7, PSR-15, PSR-18 interfaces means it should be easy to extend/embed the Proxy classes in other middlewares - avoid relying on too many, big dependencies - f.e. no Monolog, Symfony ConfigTreeBuilder - delegate all possible processing to a 'bootstrap' phase, so that the processing loop can be as efficient as possible when used in eg. `worker` mode with FrankenPHP - taking care about memory leaks - prefer end-to-end testing to unit testing, as the specific webserver used to run php does have an impact on the processing by the YAWAF code of http requests, esp. the ones which are not conforming to the http standard Testing ------- [](#testing) Given the non-trivial set of configuration required to carry out end-to-end tests, the recommended setup is to use the provided docker-based stack to run the test suite ``` ./tests/env/container.sh build ./tests/env/container.sh start ./tests/env/container.sh runtests ./tests/env/container.sh stop ``` The testsuite can be run using FrankenPHP or Apache as webserver with the following commands: `TEST_WEBSERVER=frankenphp ./tests/env/container.sh runtests` `TEST_WEBSERVER=apache ./tests/env/container.sh runtests` FAQ --- [](#faq) ... License ------- [](#license) Use of this software is subject to the terms in the [LICENSE](LICENSE) file [![License](https://camo.githubusercontent.com/fe8b786c677d1da51aeed765c5f822fe8283e0a4421a046db1343e41abe084c3/68747470733a2f2f706f7365722e707567782e6f72672f67676765656b2f7965742d616e6f746865722d7761662d636f72652f6c6963656e7365)](https://packagist.org/packages/gggeek/yet-another-waf-core)[![Latest Stable Version](https://camo.githubusercontent.com/cad78dbfca1bf3c5154704af76f06377b593d0cc38f33068b73e2deab230d6d6/68747470733a2f2f706f7365722e707567782e6f72672f67676765656b2f7965742d616e6f746865722d7761662d636f72652f762f737461626c65)](https://packagist.org/packages/gggeek/yet-another-waf-core)[![Total Downloads](https://camo.githubusercontent.com/acbd532464467e23ca47ec7027297dd4bedadd575fb31f1f65fff6d5c9de874a/68747470733a2f2f706f7365722e707567782e6f72672f67676765656b2f7965742d616e6f746865722d7761662d636f72652f646f776e6c6f616473)](https://packagist.org/packages/gggeek/yet-another-waf-core) [![Build Status](https://github.com/gggeek/yet-another-waf-core/actions/workflows/ci.yaml/badge.svg)](https://github.com/gggeek/yet-another-waf-core/actions/workflows/ci.yaml)[![Code Coverage](https://camo.githubusercontent.com/61848c9e611a80562b3ade93c8b2c5743e0c59b22afa9cc4bf1f166f4d9316f8/68747470733a2f2f636f6465636f762e696f2f6769746875622f67676765656b2f7965742d616e6f746865722d7761662d636f72652f6272616e63682f6d61696e2f67726170682f62616467652e737667)](https://app.codecov.io/github/gggeek/yet-another-waf-core) ### Health Score 21 — LowBetter than 17% of packages Maintenance64 Regular maintenance activity Popularity4 Limited adoption so far Community6 Small or concentrated contributor base Maturity11 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Community Maintainers ![](https://www.gravatar.com/avatar/f641f7d6edabf83c56f6c4998b04e6c59a00b46bf51ca6699c31b09f9c948677?d=identicon)[gggeek](/maintainers/gggeek) --- Top Contributors [![gggeek](https://avatars.githubusercontent.com/u/308634?v=4)](https://github.com/gggeek "gggeek (154 commits)") ### Embed Badge ![Health badge](/badges/gggeek-yet-another-waf-core/health.svg) ``` [![Health](https://phpackages.com/badges/gggeek-yet-another-waf-core/health.svg)](https://phpackages.com/packages/gggeek-yet-another-waf-core) ``` ### Alternatives [mews/purifier Laravel 5/6/7/8/9/10 HtmlPurifier Package 2.0k18.7M144](/packages/mews-purifier)[paragonie/ecc PHP Elliptic Curve Cryptography library 24820.0k41](/packages/paragonie-ecc) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)