WAF是Web应用的第一道防线。本文介绍WAF配置和自定义规则编写。 ## ModSecurity ```apache SecRuleEngine On SecRule REQUEST_URI "@detectSQLi" "id:1001,phase:2,deny,status:403,msg:'SQL Injection Detected'" SecRule REQUEST_URI "@detectXSS" "id:1002,phase:2,deny,status:403,msg:'XSS Detected'" ``` ## 自定义规则 ```apache SecRule REQUEST_METHOD "!@within GET POST HEAD OPTIONS" "id:2001,phase:1,deny" SecRule FILES_NAMES "@endsWith .php" "id:2003,phase:2,deny" ``` ## WAF调优 1. 初始使用DetectionOnly模式 2. 分析误报 3. 添加白名单规则 4. 切换到阻断模式 WAF不是银弹，需要与安全编码、输入验证等配合使用。