NAXSI – Open-Source, High Performance, Low Rules Maintenance WAF for Nginx

[nikolay]

https://github.com/nbs-system/naxsi

[DonHopkins]

They did not see that coming:

http://blog.memze.ro/?p=39

>Why the name “NAXSI” ?

>The name stands simply for NGINX ANTI XSS & SQL INJECTION

>Some reported us that the pronounciation is complicated and can lead to a misleading sound of “Nazi”. Of course, it’s definitely not our intent.

>Our company is based in France and pronouncing “XS” is easy for us since we have some words like this. Russians as well doesn’t have any issue with this since they have complicated sounds.

>But English & American people doesn’t have any sound like this and are hesitant in the way to pronounce it. Is it a X, is it a S and if they pronounce only the S, it then sound like nasi, not good… We didn’t saw this forcoming and are a bit sorry about that. We may change the name to NAXI to make more clear, and, of course, remove the SQL injection protections. (kidding)

[nodesocket]

NGINX Plus, the newest R10 release just integrated their own WAF using ModSecurity (https://www.nginx.com/products/web-application-firewall/).

Seems like an obvious choice to stay within the native NGINX community and just use NGINX Plus. What would be some advantages to using NAXSI?

NGINX Plus is actually not that expensive, especially since you can purchase an AMI and pay per month using AWS.

[jvoisin → nodesocket]

Modsecurity is notoriously slow, and its rules are complex to read and to write, while the naxsi ones are simple: https://github.com/nbs-system/naxsi/blob/master/naxsi_config...

[nikolay]

Here's more about NAXSI: https://www.nbs-system.co.uk/blog-2/naxsi-web-application-fi...

Although, it's sad that Nginx chose the unreleased v3 of ModSecurity [0] [1] for their commercial offering instead.

[0]: https://www.modsecurity.org/

[1]: https://github.com/SpiderLabs/ModSecurity-nginx

[TimPrice → nikolay]

Since this doesn't go well with HTTP/2 so far, we'll have to stick with ModSec for the time being.

> https://github.com/nbs-system/naxsi/issues/227

[jvoisin → TimPrice]

It seems that the issue is fixed: https://github.com/nbs-system/naxsi/issues/227#issuecomment-...

[nikolay → jvoisin]

Thanks!

[djsumdog → nikolay]

It's how they make money, but it is sad from an OSS developer perspective. At least they didn't offer it and then remove it like TypeSafe did with their Slick/MSSQL driver.

I've written a thing about this kind of business model: http://penguindreams.org/blog/the-philosophy-of-open-source-...

[thresh → djsumdog]

Why is that sad? Modsecurity sources are freely available on github - and nginx.com emails are seen in the commits.