SafeLine, make your web apps secure
SafeLine is a self-hosted web application firewall to protect your websites from attacks and exploits.
It defenses for all of web attacks, such as sql injection, code injection, os command injection, CRLF injection, ldap injection, xpath injection, rce, xss, xxe, ssrf, path traversal, backdoor, bruteforce, http-flood, bot abused and so on.
🏠Home | 📖Documentation | 🔍Live Demo | 中文版
Table of Contents
Screenshots
 |
|
|---|---|
|
|
How It Works
SafeLine is developed based on nginx, it serves as a reverse proxy middleware to detect and cleans web attacks, its core capabilities include:
- Defenses for web attacks
- Proactive bot abused defense
- HTML & JS code encryption
- IP-based rate limiting
- Web Access Control List
Security Features
Web Attacks
SafeLine uses a non-rule detection algorithm based on syntax analysis, and uses the context-free grammar commonly used in programming languages to replace the regular grammar used by traditional WAFs, which greatly improves the accuracy and recall rate of the detection algorithm.
<这里是演示视频>
Rate Limiting
Defend your applications and APIs against abuse by throttling traffic that exceeds defined limits
Rate Limiting protects against denial-of-service attacks, brute force login attempts, traffic surges, and other types of abuse targeting APIs and applications.
Choose IP-based Rate Limiting to protect unauthenticated endpoints, limit the number of requests from specific IP addresses, and handle abuse from repeat offenders.
Captcha Challenge
CAPTCHA challenges to protect your website from bot attacks, humen users will be allowed, crawlers and bots will be blocked.
Authentication Challenge
when athentication turned on, visitors need to enter the username and password information you configured below, users who do not hold the password will be blocked.
Dynamic Protection
When dynamic protection turned on, the html and javascript codes in your website will be dynamically encrypted into different random result each time you visit, it could effectively block crawlers and attack automated exploit programs.
After the html code passes through SafeLine's dynamic protection, it will be randomly encrypted and decrypted automatically when used in the browser. Please see the example below.
The left side is before encrypted, and the right side is after encrypted.
Web ACL
Quickstart
中国大陆用户安装国际版可能会导致无法连接云服务，请查看 中文版安装文档
Installing
Information on how to install SafeLine can be found in the Install Guide
Protecting Web Apps
Log into the SafeLine Web Admin Console, go to the "Site" -> "Website" page and click the "Add Site" button in the upper right corner.
In the next dialog box, enter the information to the original website.
- Domain: domain name of your original website, or hostname, or ip address, for example:
www.chaitin.com - Port: port that SafeLine will listen, such as 80 or 443. (for
httpswebsites, please check theSSLoption) - Upstream: real address of your original website, through which SafeLine will forward traffic to it
After completing the above settings, please resolve the domain name you just entered to the IP address of the server where SafeLine is located.
Then you can access the website protected by the SafeLine through the domain name like this.
Attack Simulation
Now, your website is protected by SafeLine, let’s try to attack it and see what happens.
There are some testcases for common attacks:
- SQL Injection:
https://example.com/?id=1+and+1=2+union+select+1 - XSS:
https://example.com/?id=<img+src=x+onerror=alert()> - Path Traversal:
https://example.com/?id=../../../../etc/passwd - Code Injection:
https://example.com/?id=phpinfo();system('id')
Replace example.com in the above cases with your website domain name and try to access it. Then you will see that these attacks will be blocked by SafeLine.
More Informations
Is SafeLine Production-Ready?
Yes, SafeLine is production-ready.
- Over 180,000 installations worldwide
- Protecting over 1,000,000 Websites
- Handling over 30,000,000,000 HTTP Requests Daily
Pro Version
Stargazers Over Time
Related Repo
Automaton Generator | Lua Plugin | T1K Protocol | WAF Test Tool