barbacana

Barbacana is an open-source web application firewall (WAF) and API security gateway designed to be secure by default and simple to operate. It is positioned between the public internet and user applications, inspecting all incoming HTTP requests for known attack patterns including SQL injection, cross-site scripting (XSS), command injection, path traversal, and hundreds of other common web attack vectors, blocking malicious requests before they reach backend application code. The tool prioritizes zero-configuration security: all 500+ protection rules from the OWASP Core Rule Set (CRS) v4 are enabled immediately on first deployment, with no manual rule downloads, policy writing, or specialized security expertise required. Configuration is done via simple, human-readable YAML files, with no complex web UIs needed. Users can define routing rules, content type and HTTP method restrictions, request rewriting rules, OpenAPI specification validation for API routes, multipart upload limits, and per-route rule exceptions to address false positives, all through straightforward config entries. Barbacana is designed for minimal operational overhead: it runs as a single standalone container with no external dependencies such as separate databases, monitoring dashboards, paid cloud services, or associated accounts required. It includes built-in automatic HTTPS provisioning via Let's Encrypt, handling HTTP-to-HTTPS redirects and certificate renewal with no manual configuration needed when a hostname is specified. The default rule set is tuned to balance security and low false positive rates, skipping overly aggressive rules that would break normal application traffic, while allowing users to adjust rule settings per route as needed for their specific use cases. As of version 0.5.0, Barbacana scored 93.65% on the GoTestWAF open-source WAF benchmark, blocking 84% of attack traffic while allowing 91% of normal legitimate traffic, and passes 99.75% of the official OWASP CRS go-ftw test suite. Barbacana is built on three mature open-source components: Caddy for HTTP server, TLS, HTTP/2/3 and reverse proxy functionality; Coraza as a pure Go WAF engine with no CGO dependencies; and the community-maintained OWASP CRS v4 rule set for attack detection. It abstracts away the complexity of these underlying components so users do not need to learn or configure them directly. It is worth noting that Barbacana, like all WAFs, cannot stop threats that operate at layers outside its inspection scope, including volumetric DDoS attacks, stolen credential abuse, and application logic flaws. Its core value is providing comprehensive, always-up-to-date attack pattern protection between the internet and user applications. The project is released under the Apache 2.0 license.