🐺 WolfGuard WAF for Next.js

A lightweight, edge-optimized Web Application Firewall (WAF) built specifically for Next.js Middleware.

WolfGuard helps protect your application against common Layer-7 attacks by combining threat signature detection, rate limiting, automated IP banning, and real-time security telemetry.

✨ Features

• ⚡ Edge Runtime Compatible
• 🛡️ Layer-7 Threat Detection
• 🍯 Honeypot Scanner Detection
• 🚦 Configurable Rate Limiting
• 🔨 Automatic Temporary IP Banning
• 📡 Discord SOC Alerting
• 🧩 Whitelist & Blacklist Support
• 🪶 Zero External Runtime Dependencies

📦 Installation

npm install wolfguard-next-waf

Also supports yarn add and pnpm add.

🚀 Quick Start

Secure your entire application in three lines of code. Create or update your middleware.js file:

import { WolfGuardWAF } from "wolfguard-next-waf";

const waf = new WolfGuardWAF();

export async function middleware(request) {
  return await waf.execute(request);
}

export const config = {
  matcher: [
    "/((?!_next/static|_next/image|favicon.ico).*)"
  ]
};

⚙️ Advanced Configuration

Customize the WAF to fit your exact threat model by passing a configuration object.

import { WolfGuardWAF } from "wolfguard-next-waf";

const waf = new WolfGuardWAF({
  discordWebhook: process.env.DISCORD_WEBHOOK,

  rateLimit: 100,
  timeWindow: 60 * 1000,
  banDuration: 24 * 60 * 60 * 1000,

  whitelist: ["192.168.1.10", "10.0.0.5"],
  blacklist: ["185.15.59.224"],
  
  customRules: [
    { regex: /eval\(/i, type: "Malicious Eval Injection" }
  ]
});

export async function middleware(request) {
  return await waf.execute(request);
}

📖 Configuration Reference

| Option | Type | Default | Description | | --- | --- | --- | --- | | discordWebhook | string | null | Discord webhook URL for real-time security alerts. | | rateLimit | number | 50 | Maximum requests allowed during the tracking window. | | timeWindow | number | 60000 | Tracking window in milliseconds. | | banDuration | number | 86400000 | Temporary ban duration in milliseconds. | | whitelist | string[] | [] | IP addresses that bypass all security checks. | | blacklist | string[] | [] | Permanently blocked IP addresses. | | customRules | object[] | [] | Array of custom Regex rules for threat detection. |

🛡️ Built-in Threat Detection

WolfGuard currently detects and blocks:

• Cross-Site Scripting (XSS) (<script>alert(1)</script>)
• SQL Injection (SQLi) (UNION SELECT username,password FROM users)
• Path Traversal (LFI) (../../etc/passwd)
• OS Command Injection (; bash -i)
• Sensitive File Enumeration (.env, .git, config.yaml, backup.sql)
• Admin Panel Scanners (/wp-admin, /phpmyadmin, /admin.php)

🚦 Rate Limiting

WolfGuard includes a built-in, edge-safe, in-memory rate limiter with probabilistic garbage collection to prevent memory leaks.

Requests are tracked per IP. If the limit is exceeded, the IP is automatically banned for the configured banDuration, and future requests instantly receive an HTTP 429 Too Many Requests status.

📡 Discord Security Operations Center (SOC) Alerts

When an attack is detected, WolfGuard sends a detailed, throttled alert to your private Discord channel, including:

• Threat Classification
• Target URI
• Attacker IP Address
• ISP Information
• Geo-Location & Coordinates
• User-Agent Information

This enables lightweight SOC-style monitoring without requiring expensive SIEM infrastructure.

📁 Project Structure

wolfguard-next-waf/
├── src/
│   ├── index.js
│   ├── rateLimiter.js
│   ├── signatures.js
│   ├── telemetry.js
│   └── utils.js
├── package.json
├── README.md
└── LICENSE

🔒 Security Notes

WolfGuard is intended to be an additional security layer and should not replace secure coding practices, input validation, or authentication controls. For production deployments, WolfGuard should be used alongside network-level protection such as Cloudflare or AWS Shield.

🛠️ Roadmap

• Redis-backed distributed rate limiting
• IP reputation intelligence (AbuseIPDB integration)
• Express.js and Fastify adapters
• Cloudflare Workers adapter

🤝 Contributing

Contributions, bug reports, and feature requests are welcome. If you discover a security issue, please open a private issue before submitting a public disclosure.

📄 License

MIT License Copyright (c) 2026 Pugazhmani K.