Design and Implementation of a Custom Web Application Firewall Middleware Using Node.js and React

This project presents the design and implementation of a custom Web Application Firewall (WAF) using Node.js, Express.js, React.js, and MongoDB. The developed system provides an additional layer of security by inspecting incoming HTTP requests before they reach the web application. Through a multi-stage inspection process, the firewall helps identify and block various malicious activities that may compromise application security. The implemented rule engine successfully detects common web application attacks such as SQL Injection, Cross-Site Scripting (XSS), Path Traversal, Command Injection, LDAP Injection, and XML Injection. Additional security features including rate limiting, automatic IP blacklisting, structured logging, and attack data storage further enhance the effectiveness of the system. The integration of MongoDB enables the storage of security events for future analysis, while the React-based dashboard provides real-time visibility into attack statistics and suspicious activities. These features help administrators monitor security threats and respond to potential risks more effectively. The project demonstrates how modern web technologies can be used to build a practical, customizable, and cost-effective security solution. It also provides valuable insights into web application security, attack detection techniques, and defensive security mechanisms. Overall, the developed WebShield system serves as a strong foundation for improving web application security and can be extended with advanced features as future security requirements evolve.

[1] OWASP Foundation, "OWASP Top Ten Web Application Security Risks," Open Web Application Security Project, 2021. [Online]. Available: https://owasp.org/www-project-top-ten/ [2] R. Fielding and J. Reschke, "Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing," Internet Engineering Task Force (IETF), RFC 7230, June 2014. [Online]. Available: https://tools.ietf.org/html/rfc7230 [3] W. Stallings, Cryptography and Network Security: Principles and Practice, 8th ed. Hoboken, NJ, USA: Pearson, 2019. [4] OWASP Foundation, "SQL Injection Prevention Cheat Sheet," Open Web Application Security Project, 2023. [Online]. Available: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html [5] OWASP Foundation, "Cross Site Scripting Prevention Cheat Sheet," Open Web Application Security Project, 2023. [Online]. Available: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html [6] OWASP Foundation, "Path Traversal," Open Web Application Security Project, 2023. [Online]. Available: https://owasp.org/www-community/attacks/Path_Traversal [7] Node.js Foundation, "Node.js Documentation," OpenJS Foundation, 2023. [Online]. Available: https://nodejs.org/en/docs/ [8] Express.js Contributors, "Express.js Web Framework Documentation," OpenJS Foundation, 2023. [Online]. Available: https://expressjs.com/ [9] W. G. J. Halfond, J. Viegas, and A. Orso, "A Classification of SQL Injection Attacks and Countermeasures," in Proc. IEEE Int. Symp. Secure Software Engineering, Arlington, VA, USA, Mar. 2006, pp. 13–15. [10] P. Bisht and V. N. Venkatakrishnan, "XSS-GUARD: Precise Dynamic Prevention of Cross-Site Scripting Attacks," in Proc. 5th Int. Conf. Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), Paris, France, 2008, pp. 23–43.