iph-waf

Reusable Express WAF middleware for common malicious traffic patterns.

What it does

This library can block:

• common SQL injection patterns
• common XSS payloads
• command injection attempts
• path traversal attempts
• SSRF-style host probes
• suspicious user agents
• suspicious request headers
• requests hitting honeypot paths

It also does lightweight per-IP blocking in memory.

Basic usage

import express from "express";
import { createWaf } from "iph-waf";

const app = express();
app.use(createWaf());

Custom configuration example

app.use(
  createWaf({
    maxRequests: 100,
    blockTimeMs: 10 * 60 * 1000,
    minimumUserAgentLength: 12,
    honeypots: ["/wp-admin", "/.env", "/internal-debug"],
  }),
);

Options

• blockedPatterns: regex list to scan URL, query, and body values.
• blockedAgents: blocked user-agent fragments.
• suspiciousHeaders: blocked header names.
• honeypots: trap paths to block.
• maxRequests: in-memory request threshold per IP.
• blockTimeMs: temporary block duration.
• minimumUserAgentLength: minimum allowed user-agent string length.

Implementation notes

• Put this very early in the middleware chain.
• The built-in IP memory map is process-local, so it is best for single-instance setups.
• Review blocked user agents before using this in customer-facing products, because aggressive rules can block legitimate tools.
• Test your frontend and mobile clients to make sure their headers and agents are allowed.