Chaitin WAF | APISIX & API7 API Gateway Docs

Parameters

See plugin common configurations for configuration options available to all plugins.

mode
string
default: block
vaild vaule:
off, monitor, or block
Mode to determine how the plugin behaves for matched requests.
In off mode, WAF checks are skipped. In monitor mode, requests with potential threats are logged but not blocked. In block mode, requests with threats are blocked as determined by the WAF service.
match
array[object]
An array of matching rules. The plugin uses these rules to decide whether to perform a WAF check on a request. If the list is empty, all requests are processed.
- vars
  array[array]
  An array of one or more matching conditions in the form of APISIX expressions to conditionally execute the plugin.
append_waf_resp_header
boolean
default: true
If true, add response headers X-APISIX-CHAITIN-WAF, X-APISIX-CHAITIN-WAF-TIME, X-APISIX-CHAITIN-WAF-ACTION, and X-APISIX-CHAITIN-WAF-STATUS.
append_waf_debug_header
boolean
default: false
If true, add debugging headers X-APISIX-CHAITIN-WAF-ERROR and X-APISIX-CHAITIN-WAF-SERVER to the response. Effective only when append_waf_resp_header is true.
config
object
Chaitin WAF service configurations. These settings override the corresponding metadata defaults when specified.
- connect_timeout
  integer
  default: 1000
  The connection timeout to the WAF service, in milliseconds.
- send_timeout
  integer
  default: 1000
  The sending timeout for transmitting data to the WAF service, in milliseconds.
- read_timeout
  integer
  default: 1000
  The reading timeout for receiving data from the WAF service, in milliseconds.
- req_body_size
  integer
  default: 1024
  The maximum allowed request body size, in KB.
- keepalive_size
  integer
  default: 256
  The maximum number of idle connections to the WAF detection service that can be maintained concurrently.
- keepalive_timeout
  integer
  default: 60000
  The idle connection timeout for the WAF service, in milliseconds.
- real_client_ip
  boolean
  default: true
  If true, the client IP is obtained from the X-Forwarded-For header. If false, the plugin uses the client IP from the connection.

Plugin Metadata

nodes
array[object]
required
An array of addresses for the Chaitin WAF service.
- host
  string
  required
  Address of Chaitin WAF service. Supports IPv4, IPv6, Unix Socket, etc.
- port
  integer
  default: 80
  Port of Chaitin WAF service.
mode
string
default: block
Mode to determine how the plugin behaves for matched requests.
In off mode, WAF checks are skipped. In monitor mode, requests with potential threats are logged but not blocked. In block mode, requests with threats are blocked as determined by the WAF service.
config
object
Chaitin WAF service configurations.
- connect_timeout
  integer
  default: 1000
  The connection timeout to the WAF service, in milliseconds.
- send_timeout
  integer
  default: 1000
  The sending timeout for transmitting data to the WAF service, in milliseconds.
- read_timeout
  integer
  default: 1000
  The reading timeout for receiving data from the WAF service, in milliseconds.
- req_body_size
  integer
  default: 1024
  The maximum allowed request body size, in KB.
- keepalive_size
  integer
  default: 256
  The maximum number of idle connections to the WAF detection service that can be maintained concurrently.
- keepalive_timeout
  integer
  default: 60000
  The idle connection timeout for the WAF service, in milliseconds.
- real_client_ip
  boolean
  default: true
  If true, the client IP is obtained from the X-Forwarded-For header. If false, the plugin uses the client IP from the connection.

Parameters​

Plugin Metadata​

Parameters

Plugin Metadata