I'm looking for a nice rules-based web app firewall (WAF) that I can use with my Java EE web app (WAR). So far I have scouted out Stinger from OWASP and ModSec (for Java). Stinger is newer but is not considered a full-blown WAF, and I'm only skepitcal with ModSecurity because it seems old and possibly outdated/discontinued (manual is copyrighted 2001 - 2004).
Can anyone recommend a good, free, open source WAF for Java EE web apps? At th very least, I need to secure/filter my HTTP/S headers. Thanks in advance!
You can try WebCastellum:
Java-based Open Source WAF (Web Application Firewall) to include inside a web application in order to protect it against attacks like SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Parameter Manipulation and many more.