ModSecurity Trustwave
This blog has moved! Please update your
bookmarks to

ModSecurity Blog: January 2005

PHP Security Consortium goes live

Now it is official. The PHP Security Consortium web site is live. (Read the press release.) A month or so ago, Chris Schiflett (who is also writing a book called "PHP Security" at the moment) decided to improve the state of PHP security. So he invited a group of people interested in the subject. I was one of them.

In January we discussed the organisation of the Consortium, the mission statement, the projects, and we created the web site. There is only one project live at the moment but it is very important. It's the PHP Security Guide, and it's based on the previously published PHP Security Workbook (which Chris wrote).

ModSecurity for Java Milestone 3 now available

I have just released an updated version of ModSecurity for Java. This version implements the core functionality (request and response interception), and it contains a complete implementation of the portable web application firewall rule format. As I was uploading the archive I realized that, although I've been (slowly) working on it for more than a year now, this project had no home page. And so I made WAS Protect (follow the link for the latest specification) the fifth project hosted on

I expect I will need two more versions before a production-ready release. ModSecurity for Java is important for two reasons. First, the functionality it implements is effectively that of ModSecurity 2.0 format. Therefore the Java version will be slightly more advanced than the Apache version. Single-process multi-threaded operation of Java web servers will allow me to experiment with new features, especially the stateful operation. This is something I wanted to do for a long time. After I get these features right they will be ported to the Apache version.

The second reason ModSecurity for Java is important is the fact it implements the portable web application firewall rule format. I do believe that a portable format has a potential to move web application firewalls to a new level of usefulness. But the hard part will be convincing the vendors to implement the format. Technically, it's not a problem. The format is in XML and it's very simple. It's not clear what will happen to this work though. As I already mentioned, it's part of a larger undertaking done under the label of OASIS Web Application Security Technical Committee. After a year of no or very little activity, the committee is starting to show signs of activity again. This is mostly due to the entusiasm of Peter Michalek, the new Chair. Still, I am not convinced we have enough man power to handle the work load efficiently. Anyway, I've done my part I'll now see if I can help with something else (time permitting, of course).