阅读中文版本

Build a WAF Rule Engine

WAF Rule Engine — a complete walkthrough of web application firewalling, covering rule loader, pattern matcher, score accumulator, and testing.

waf_rule_engine/
├── src/index.ts
├── src/rule-loader.ts
├── src/pattern-matcher.ts
├── tests/waf_rule_engine.test.ts
└── package.json

// Rule loader: web application firewalling core
export function ruleloader(input: RuleloaderInput): RuleloaderResult {
  // Build the rule loader that anchors web application firewalling and defines the core data shape.
  return processRuleloader(input);
}

// Pattern matcher — handles web application firewalling Add the pattern matcher so
export class Patternmatcher {
  constructor(private opts: PatternmatcherOptions) {}
  async run(ctx: Context): Promise<PatternmatcherOutput> {
    return this.execute(ctx);
  }
}

// Score accumulator: web application firewalling stage
export const scoreaccumulator = (next: Next) => async (req: Request) => {
  const out = await transform(req);
  return next(out);
};

// Action dispatcher for web application firewalling
export async function actiondispatcher(stream: AsyncIterable<Chunk>): Promise<Aggregate> {
  let acc = init();
  for await (const c of stream) acc = merge(acc, c);
  return acc;
}

// Rule hot-reload: web application firewalling finalization
export function rulehotreload(state: State): Result {
  validate(state);
  return finalize(state);
}

Project overview

This project builds a web application firewalling system whose reason for existing is evaluating request signatures against a rule set fast enough to sit in the hot path. The temptation in web application firewalling is to bolt the interesting part onto a working prototype and discover the hard cases in production; this build inverts that order and treats a regex with catastrophic backtracking that turns a malicious request into a CPU denial of service as the first thing designed, not the last.

You will implement Rule loader, Pattern matcher, Score accumulator, Action dispatcher, and Rule hot-reload, each as a module with one responsibility and a test that proves it in isolation. The web application firewalling pipeline is then the wiring that composes them, and the integration test is where the composition is shown to survive a regex with catastrophic backtracking that turns a malicious request into a CPU denial of service.

The walkthrough is written for a developer who has used a web application firewalling system but has not had to make one honest. It favors explicit data shapes over clever abstractions, and it names the failure each design choice prevents rather than presenting the choice as a style preference.

Each phase ends with something observable — a rule loader that returns the right shape, a pattern matcher that rejects bad input, an integration test that goes green — so you can stop at any point and still have a web application firewalling system that works for the cases covered so far.

What you will build

The finished web application firewalling system exposes five capabilities, each with a focused test:

• Rule loader
• Pattern matcher
• Score accumulator
• Action dispatcher
• Rule hot-reload

Rule loader is the foundation that every later stage assumes; Pattern matcher is where web application firewalling correctness lives; Score accumulator handles a regex with catastrophic backtracking that turns a malicious request into a CPU denial of service; Action dispatcher makes the system observable; and Rule hot-reload is the graceful-degradation layer that keeps overload from becoming corruption.

The build keeps the web application firewalling logic in ordinary modules you can read in one sitting, and pulls in dependencies only for the parts that are genuinely tedious to hand-roll. That keeps the diff between the tutorial and a real codebase small, and keeps the failure modes visible in code rather than hidden behind a framework.

Architecture and data model

The system is organized around Rule loader, Pattern matcher, and Score accumulator, with Action dispatcher tying them together. Data flows as a compiled set of rules each with a pattern, a weight, and an action, evaluated in order with a running anomaly score.

Each component is a module with a pure interface where practical: the same input produces the same output, and side effects are pushed to the edges. That discipline is what makes the phases independently testable, because a test for Score accumulator does not need to stand up Rule loader and Pattern matcher to exercise the interesting branch.

The data model is deliberately explicit. A compiled set of rules each with a pattern, a weight, and an action, evaluated in order with a running anomaly score Keeping the shape written down — in a schema, a type, or a fixture — means a change to the shape is a visible diff rather than a silent runtime shift, and it means the integration test can assert against a concrete shape instead of guessing.

Configuration and code are kept apart: the configuration says what web application firewalling should do, the modules say how. A reviewer can change a threshold or a policy without reading the implementation, which keeps the risky changes small and lets the diff stand as the review.

The failure path through Score accumulator is designed before the happy path is finished, because a regex with catastrophic backtracking that turns a malicious request into a CPU denial of service is the case that distinguishes a web application firewalling system from a demo. Every component declares what it does when its inputs are wrong, and the integration test asserts each of those declarations.

Prerequisites and dependencies

Have these ready before you install anything, so the web application firewalling setup is not blocked by a missing tool:

• Node.js 20 LTS or later
• Familiarity with web application firewalling fundamentals
• A local environment to run the test suite

The runtime dependencies are chosen to keep the web application firewalling datapath legible:

• fastify (^5.0.0) — Inspection hook
• re2 (^1.21.0) — Linear-time regex

# setup for waf-rule-engine
pnpm init
pnpm add fastify re2
pnpm add -D typescript tsx vitest

Versions are pinned to a major range so the web application firewalling install is reproducible; commit the lockfile. The rule loader reads its operational parameters from the environment and validates them at startup, so a missing value fails the boot rather than the first web application firewalling request.

Directory structure

Keep each web application firewalling component in its own file so it can be tested without starting the others:

waf_rule_engine/
├── src/index.ts
├── src/rule-loader.ts
├── src/pattern-matcher.ts
├── tests/waf_rule_engine.test.ts
└── package.json

Phase 1: Rule loader

Build the rule loader that anchors web application firewalling and defines the core data shape.

// Rule loader: web application firewalling core
export function ruleloader(input: RuleloaderInput): RuleloaderResult {
  // Build the rule loader that anchors web application firewalling and defines the core data shape.
  return processRuleloader(input);
}

After this phase the rule loader works in isolation and is covered by a unit test. The rule loader defines the data shape that every later stage assumes, so getting it right first means the later phases compile against a stable contract.

Treat the rule loader as the single source of truth for the web application firewalling data shape. Validate inputs at the boundary and reject early, so a malformed value never reaches Pattern matcher or Score accumulator where its effect would be harder to localize.

Phase 2: Pattern matcher

Add the pattern matcher so web application firewalling can evaluating request signatures against correctly.

// Pattern matcher — handles web application firewalling Add the pattern matcher so
export class Patternmatcher {
  constructor(private opts: PatternmatcherOptions) {}
  async run(ctx: Context): Promise<PatternmatcherOutput> {
    return this.execute(ctx);
  }
}

After this phase the pattern matcher works in isolation and is covered by a unit test. This is where web application firewalling correctness lives: the pattern matcher is what makes evaluating request signatures against a rule set fast enough to sit in the hot path true, and its test is the proof.

Keep the pattern matcher pure where you can. A function that takes an input and returns an output is trivial to test and impossible to mock wrong; a class with hidden state is the opposite. Push side effects to the caller and keep the pattern matcher about the transformation.

Phase 3: Score accumulator

Wire the score accumulator to handle a regex with catastrophic without losing data.

// Score accumulator: web application firewalling stage
export const scoreaccumulator = (next: Next) => async (req: Request) => {
  const out = await transform(req);
  return next(out);
};

After this phase the score accumulator works in isolation and is covered by a unit test. The score accumulator is the difference between a web application firewalling system that works on the happy path and one that survives a regex with catastrophic backtracking that turns a malicious request into a CPU denial of service.

Design the failure before the success. Decide what score accumulator does when a regex with catastrophic backtracking that turns a malicious request into a CPU denial of service: reject, retry, shed, or degrade — and write that test first. A web application firewalling system whose failure behavior is unspecified will pick one at random under pressure, and it is usually the wrong one.

Phase 4: Action dispatcher

Integrate the action dispatcher to make web application firewalling observable and testable end to end.

// Action dispatcher for web application firewalling
export async function actiondispatcher(stream: AsyncIterable<Chunk>): Promise<Aggregate> {
  let acc = init();
  for await (const c of stream) acc = merge(acc, c);
  return acc;
}

After this phase the action dispatcher works in isolation and is covered by a unit test. Observability is not a finishing touch; it is how you know the web application firewalling system is doing what it claims in production.

Emit one structured event per meaningful action, with enough context to localize a failure without a second round-trip. The action dispatcher is what turns “something is slow” into “the pattern matcher is slow for inputs matching this shape,” which is the difference between an alert and an investigation.

Phase 5: Rule hot-reload

Finalize the rule hot-reload so the web application firewalling system degrades gracefully under overload.

// Rule hot-reload: web application firewalling finalization
export function rulehotreload(state: State): Result {
  validate(state);
  return finalize(state);
}

After this phase the rule hot-reload works in isolation and is covered by a unit test. The rule hot-reload is what keeps overload from becoming corruption: when the web application firewalling system is asked for more than it can do, it degrades in a defined way instead of failing in an undefined one.

Pick a degradation strategy for rule hot-reload — shed, queue, or backpressure — and make it explicit in code and in a test. Leaving the behavior to chance is how a web application firewalling traffic spike becomes a data loss incident.

Testing

Each phase has a focused test: rule loader, pattern matcher, and score accumulator are exercised in isolation, then an integration test drives the full web application firewalling pipeline and asserts the a regex with catastrophic case is handled.

Start with unit tests that pin each component’s contract: the rule loader returns the documented shape, the pattern matcher transforms correctly, and the score accumulator fails in the documented way. These tests are fast and they localize regressions to the component that broke.

Then add an integration test that composes the components and drives a realistic web application firewalling scenario end to end. Assert the happy path first, then deliberately trigger a regex with catastrophic backtracking that turns a malicious request into a CPU denial of service and assert the system degrades rather than corrupts. Because the components are pure where practical, the integration test stays deterministic rather than flaky.

A web application firewalling suite must also prove the negative: bad input is rejected at the boundary, overload is shed rather than queued indefinitely, and a partial failure does not leave the system in an inconsistent state. These are the tests that catch the regressions a happy-path suite never would.

The entire web application firewalling suite runs with no external service; every dependency is either in-process or stubbed, so every case is reproducible in CI. That is what lets the score accumulator failure-mode assertions live as tests rather than as a manual checklist that drifts out of date.

# run the web application firewalling test suite
pnpm vitest run

Deployment and operations

Run at least two web application firewalling instances behind a load balancer and share state in Redis. Set resource limits so web application firewalling overload surfaces as backpressure rather than failure.

Run at least two stateless instances behind a load balancer, and move any shared state into a shared store so the web application firewalling behavior is global rather than per instance. Size limits so the system sheds load before it runs out of memory, because a web application firewalling system that OOMs under load fails in a way that is hard to reason about.

Drain on deploy: stop accepting new work, let in-flight web application firewalling operations finish, then exit. Because the system holds no state that cannot be reconstructed, a rollout is a matter of cycling instances one at a time while watching the error rate.

When a dependency is unavailable, decide explicitly whether the web application firewalling system fails closed or degrades. Leaving that choice to chance is how a dependency outage becomes a silent data loss, so make the choice visible in code and in a test.

Security considerations

Validate all web application firewalling inputs at the boundary, reject oversized payloads before buffering them, and keep secrets in the environment rather than the repository.

The web application firewalling system is a choke point, so it is the right place to reject malformed input before it reaches pattern matcher or score accumulator. Validate the shape and the size at the edge, and let the inner components assume what they receive is well-formed.

Never log secrets or full payloads; log enough to localize a failure without recording data that should not be on disk. Treat any external call as untrusted and validate its response before using it, because a web application firewalling system that trusts its inputs blindly is one malformed response away from corruption.

Keep dependencies pinned and run an audit in CI. A transitive dependency with a known vulnerability is still a vulnerability in your web application firewalling system, and the lockfile is what makes the audit meaningful.

Observability

Emit one structured event per web application firewalling operation with the inputs’ shape, the outcome, and a correlation id. Track error rate and latency per component and alert on a step change rather than a single spike.

The correlation id is the thread that ties a user-visible symptom to the web application firewalling decision and to the component log entry for the same operation. Without it, an investigation starts from a timestamp and a guess.

Watch the score accumulator failure rate separately from the overall error rate. A jump in score accumulator failures usually means a regex with catastrophic backtracking that turns a malicious request into a CPU denial of service, not a bug in pattern matcher, and the two have different owners and different fixes.

Chart the share of web application firewalling operations that shed, queue, or succeed. A change in the mix points at the cause faster than an aggregate latency can, because each class has a different root.

Troubleshooting

A regex with catastrophic backtracking that turns a malicious request into a CPU denial of service. Reproduce with a minimal fixture, then add a guard test so the web application firewalling system rejects the condition loudly.

Performance regresses under web application firewalling load. Profile with the sampling analyzer, locate the hot path in pattern matcher, and add a targeted benchmark to lock the regression.

Keep the web application firewalling dashboards separate from dependency dashboards. When an operation fails, the correlation id lets you decide in seconds whether the fault is rule loader, pattern matcher, or score accumulator, instead of guessing from a timeout.

Limitations and next steps

• Single-region; multi-region replication is out of scope.
• The rule loader is in-process and not horizontally shared by default.
• No auth layer; assume deployment behind an edge that enforces identity.

The web application firewalling system is single-region by design; extending to multi-region means making rule loader shareable across regions, which is a real change to the consistency model rather than a config flag. The score accumulator is in-process, which is correct for one instance but must move to a shared store before scaling out.

There is no authentication or authorization layer; the system assumes it is deployed behind an edge that enforces identity. Adding one is straightforward but out of scope for this build, and doing it here would distract from the web application firewalling correctness that is the point.

The natural next step, once the web application firewalling pipeline is trusted in production, is to add a short-TTL cache for idempotent reads and a richer action dispatcher that exports histograms rather than counters. Both are additive and neither changes the contracts this build establishes.