PHP 怎么PHP Coraza

wen PHP项目 2026-07-30 4

本文目录导读：

PHP 怎么PHP Coraza

PHP Coraza 使用指南
安装
基本使用示例
注意事项
推荐配置

PHP Coraza 使用指南

Coraza 是一个用于 PHP 的 Web 应用防火墙（WAF），它实现了 OWASP ModSecurity 核心规则集（CRS）,让我详细介绍如何使用它。

安装

通过 Composer 安装

composer require coraza/coraza

基本使用示例

简单集成示例

<?php
require_once 'vendor/autoload.php';
use Coraza\Coraza;
use Coraza\RuleEngine;
// 初始化 WAF
$waf = new Coraza();
// 加载 OWASP CRS 规则
$waf->loadRules('/path/to/coreruleset/rules/');
// 创建规则引擎
$engine = new RuleEngine($waf);
// 分析请求
$request = [
    'method' => 'POST',
    'uri' => '/api/login',
    'headers' => [
        'User-Agent' => 'Mozilla/5.0',
        'Content-Type' => 'application/x-www-form-urlencoded'
    ],
    'body' => 'username=admin&password=123456'
];
// 执行规则检查
$result = $engine->processRequest($request);
// 检查是否被拦截
if ($result->isBlocked()) {
    // 记录攻击信息
    error_log("攻击被阻止: " . $result->getMessage());
    // 返回 403 错误
    http_response_code(403);
    echo "Access Denied";
    exit;
}
// 继续正常处理请求
echo "请求通过安全检测";
?>

中间件模式（推荐用于框架）

<?php
class CorazaMiddleware {
    private $coraza;
    public function __construct() {
        $this->coraza = new Coraza();
        $this->coraza->loadRules('/path/to/crs/rules/');
    }
    public function handle($request, $next) {
        $engine = new RuleEngine($this->coraza);
        // 构建请求数据
        $requestData = [
            'method' => $request->getMethod(),
            'uri' => $request->getRequestUri(),
            'headers' => $request->headers->all(),
            'body' => $request->getContent(),
            'query' => $request->query->all(),
            'files' => $request->files->all()
        ];
        // 执行安全检测
        $result = $engine->processRequest($requestData);
        if ($result->hasRuleMatch()) {
            // 记录安全事件
            $this->logSecurityEvent($result);
            // 根据严重程度处理
            if ($result->getSeverity() >= 4) {
                return response('Forbidden', 403);
            }
            // 可选：添加自定义响应头
            header('X-Coraza-Blocked: ' . $result->getRuleId());
        }
        return $next($request);
    }
    private function logSecurityEvent($result) {
        $logEntry = [
            'timestamp' => date('Y-m-d H:i:s'),
            'rule_id' => $result->getRuleId(),
            'message' => $result->getMessage(),
            'ip' => $_SERVER['REMOTE_ADDR'],
            'uri' => $_SERVER['REQUEST_URI']
        ];
        // 写入日志
        file_put_contents(
            '/var/log/coraza/security.log',
            json_encode($logEntry) . "\n",
            FILE_APPEND
        );
    }
}
// 在 Laravel 中注册中间件
// app/Http/Kernel.php
protected $routeMiddleware = [
    // ...
    'coraza' => \App\Http\Middleware\CorazaMiddleware::class,
];

自定义规则配置

<?php
// 创建自定义规则集
$customRules = [
    [
        'id' => 100001,
        'phase' => 1,
        'severity' => 5,
        'message' => 'SQL Injection Attempt Detected',
        'match' => [
            'field' => 'body',
            'pattern' => "/(union.*select|select.*from|insert.*into|drop.*table)/i"
        ]
    ],
    [
        'id' => 100002,
        'phase' => 2,
        'severity' => 3,
        'message' => 'XSS Attack Detected',
        'match' => [
            'field' => 'body',
            'pattern' => "/<script.*?>.*?<\/script>/i"
        ]
    ]
];
// 加载自定义规则
$waf = new Coraza();
$waf->addCustomRules($customRules);
// 或者从文件加载规则
$waf->loadRulesFromFile('/path/to/custom_rules.conf');
?>

性能优化配置

<?php
// 性能优化示例
$waf = new Coraza([
    'cache_enabled' => true,
    'cache_size' => 10000,  // 缓存大小
    'cache_ttl' => 300,      // 缓存时间（秒）
    'max_rules' => 1000,     // 最大规则数
    'performance_mode' => 'balanced'  // 'maximum', 'balanced', 'minimum'
]);
// 启用请求缓存
$waf->enableRequestCache();
// 设置白名单
$waf->addWhitelist([
    '/api/health',
    '/api/status',
    '/public/*'
]);
// 设置 IP 白名单
$waf->addIpWhitelist([
    '192.168.1.0/24',
    '10.0.0.0/8'
]);
?>

完整的安全配置示例

<?php
require_once 'vendor/autoload.php';
use Coraza\Coraza;
use Coraza\RuleEngine;
use Monolog\Logger;
use Monolog\Handler\StreamHandler;
class SecurityManager {
    private $coraza;
    private $logger;
    public function __construct() {
        // 初始化日志
        $this->logger = new Logger('coraza');
        $this->logger->pushHandler(
            new StreamHandler('/var/log/coraza/security.log', Logger::WARNING)
        );
        // 初始化 Coraza
        $this->initCoraza();
    }
    private function initCoraza() {
        $this->coraza = new Coraza([
            'performance_mode' => 'balanced',
            'max_request_size' => '10MB',
            'enabled_phases' => [1, 2, 3, 4]
        ]);
        // 加载 OWASP CRS
        $this->coraza->loadRules('/etc/coraza/crs/');
        // 加载自定义规则
        $this->coraza->loadRulesFromFile('/etc/coraza/custom_rules.conf');
        // 配置例外
        $this->coraza->addException('/api/webhook', 'POST');
        $this->coraza->addException('/healthcheck', 'GET');
        // 配置响应
        $this->coraza->setBlockingPage('/errors/403.html');
        $this->coraza->setResponseHeader('X-Protected-By', 'Coraza WAF');
    }
    public function processRequest($request) {
        $engine = new RuleEngine($this->coraza);
        try {
            $result = $engine->processRequest($request);
            if ($result->hasRuleMatch()) {
                $this->handleAttack($result, $request);
                return false;
            }
            return true;
        } catch (\Exception $e) {
            $this->logger->error("Coraza processing error: " . $e->getMessage());
            // 故障开放模式：WAF 崩溃，仍然允许请求
            return true;
        }
    }
    private function handleAttack($result, $request) {
        // 记录攻击详情
        $this->logger->warning("Security block", [
            'rule_id' => $result->getRuleId(),
            'message' => $result->getMessage(),
            'severity' => $result->getSeverity(),
            'ip' => $_SERVER['REMOTE_ADDR'],
            'uri' => $request['uri'],
            'method' => $request['method'],
            'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? 'unknown'
        ]);
        // 严重攻击可以触发额外的安全措施
        if ($result->getSeverity() >= 4) {
            $this->triggerHighSeverityResponse($result);
        }
        // 设置安全响应
        http_response_code(403);
        header('Content-Type: application/json');
        echo json_encode([
            'error' => 'Request blocked',
            'reason' => 'Security violation detected',
            'reference' => $result->getRuleId()
        ]);
        exit;
    }
    private function triggerHighSeverityResponse($result) {
        // 可以在这里实现额外的安全措施
        // 临时封禁 IP、发送警报邮件等
        $this->logger->critical("High severity attack detected!");
    }
}
// 使用示例
$security = new SecurityManager();
$request = [
    'method' => $_SERVER['REQUEST_METHOD'],
    'uri' => $_SERVER['REQUEST_URI'],
    'headers' => getallheaders(),
    'body' => file_get_contents('php://input'),
    'query' => $_GET,
    'files' => $_FILES
];
if ($security->processRequest($request)) {
    // 继续处理请求
    echo "Request allowed";
}
?>