socfortress/waf-platform-public v1.0.29

v1.0.29 — Trusted-IP bypass and JSON parsing fixes

on GitHub

What's new

Full trusted-IP bypass

Rules → Method Exceptions now offers Full trusted-IP bypass — all methods. Matching IPs bypass WAF blocking for every HTTP method, including PATCH and DELETE. This skips Coraza/CRS and custom rules, body inspection, method restrictions, IP and country blocks, reputation checks and rate limits.

Hostname scope still applies: use an exact hostname for one site or * for all enabled sites. Authentication, response security headers and the upstream application's own access controls remain active. Existing selected-method exceptions keep their original behavior until explicitly switched to full bypass.

• Full bypass uses Caddy's resolved client IP; untrusted forwarding headers cannot grant the bypass.
• Source entries are validated as IPv4/IPv6 addresses or CIDRs.
• The UI clearly identifies full-bypass entries and lets you switch back to selected methods.
• API clients select full bypass with methods: ["*"]; it cannot be combined with named methods. No database migration is required for this feature.

JSON request inspection fixes, included from v1.0.28

JSON API bodies are now explicitly parsed as JSON before CRS inspection, preventing entire JSON documents from being treated as form argument names and falsely matching SQL-injection rules. The parser supports JSON media types with charset parameters and application +json subtypes. Malformed request bodies are rejected with HTTP 400 when body inspection detects a parsing failure.

Selected-method exceptions continue to bypass only method restrictions. Use the new full trusted-IP behavior when the intended policy is to bypass all WAF blocking for listed IPs.

Upgrade

git pull
# Set WAF_IMAGE_TAG=1.0.29 in .env to pin this release.
docker compose pull
docker compose up -d

If you previously installed temporary local hotfix images, remove their image and associated pull_policy: never overrides before upgrading. Preserve unrelated Compose customizations. Otherwise those services will remain pinned to the local hotfix instead of using the release images.

All three images are published for linux/amd64:

• ghcr.io/socfortress/waf-caddy:1.0.29
• ghcr.io/socfortress/waf-admin-api:1.0.29
• ghcr.io/socfortress/waf-admin-ui:1.0.29

latest also points to this release. Before downgrading to an older version, disable full-bypass entries or switch them back to selected methods; older versions do not understand the methods: ["*"] behavior.

Validation

192 backend tests, 13 Rules UI tests and the frontend production build passed. An additional 26 isolated HTTP checks verified full-routing behavior, including trusted-client bypass, continued blocking for untrusted clients, hostname scope and spoofed forwarding headers. Test requests used static upstream responses and did not reach protected applications.