Java EE Web App Firewall

Question

I'm looking for a nice rules-based web app firewall (WAF) that I can use with my Java EE web app (WAR). So far I have scouted out Stinger from OWASP and ModSec (for Java). Stinger is newer but is not considered a full-blown WAF, and I'm only skepitcal with ModSecurity because it seems old and possibly outdated/discontinued (manual is copyrighted 2001 - 2004).

Can anyone recommend a good, free, open source WAF for Java EE web apps? At th very least, I need to secure/filter my HTTP/S headers. Thanks in advance!

Answer 1

You can try WebCastellum:

Java-based Open Source WAF (Web Application Firewall) to include inside a web application in order to protect it against attacks like SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Parameter Manipulation and many more.

• Website: http://www.webcastellum.org/
• Sourceforge: http://sourceforge.net/projects/webcastellum/