api-firewall: Open Source API Development & Testing

What is api-firewall?

API Firewall is an open-source reverse proxy from Wallarm that validates API requests and responses against OpenAPI 3.0 and GraphQL schemas, and it is built for platform, security, and backend teams that need to protect REST and GraphQL endpoints in cloud-native environments.

What it is

API Firewall is a high-performance proxy written in Go on top of the fasthttp proxy and released under the MPL-2.0 licence. On start it is given the REST or GraphQL specification of the application it protects, then acts as a reverse proxy that checks whether every request and response matches the schema in that specification. It uses a positive security model: calls matching the predefined specification are allowed, everything else is rejected or logged. It runs in three modes — PROXY, which validates HTTP requests and responses against OpenAPI 3.0 and proxies matches to the backend; API, which validates individual requests against OpenAPI 3.0 without proxying; and graphql, which validates HTTP and WebSocket requests against a GraphQL schema and proxies matches.

The problem it solves is the gap between the API contract an application publishes and the traffic it actually receives. Without a validating layer a backend accepts any well-formed call and can return any payload, so malformed requests reach application code and malformed or over-sharing responses leave the system. API Firewall fills the reverse proxy or gateway slot in front of the backend, making schema conformance an enforcement point rather than a documentation promise, driven by the same OpenAPI or GraphQL document the team already maintains. In monitoring mode it also logs shadow API endpoints — routes that respond but are absent from the specification, except those returning 404.

Key capabilities

Operating modes PROXY, API, and graphql, covering OpenAPI 3.0 request and response validation, standalone request validation, and GraphQL validation over HTTP and WebSocket.
Positive security model that blocks malicious requests and malformed API responses which could expose sensitive data.
JWT access token validation for OAuth 2.0 protocol-based authentication.
Denylisting of compromised API tokens, keys, and Cookies.
AllowIPList for restricting endpoint access to a defined list of allowed IP addresses.
ModSecurity Rules and OWASP ModSecurity Core Rule Set support for wide range attacks protection.
Validation across Content-Type values including application/json, application/xml, application/octet-stream, application/x-www-form-urlencoded, application/x-yaml, and application/yaml, with results logged through the STDOUT and STDERR Docker services.

Who uses it and how

Security and platform teams protecting REST and GraphQL APIs in cloud-native environments, running API Firewall as a Docker container in front of backend services.
Teams in blocking mode, stopping requests that do not match the specification and stopping malformed responses before they leak data.
Teams in monitoring mode, discovering shadow APIs and logging malformed traffic without rejecting it during a migration.
Operators who already maintain ModSecurity rules or the OWASP ModSecurity Core Rule Set and want them applied at the API layer; the Docker image has passed 1 billion pulls, and the project was presented at Black Hat Arsenal USA 2022.

Getting started

API Firewall ships as the wallarm/api-firewall Docker image on DockerHub, and the homepage at https://wallarm.github.io/api-firewall/ provides Docker container installation guides for both OpenAPI and GraphQL. Deployment begins by supplying the application specification and selecting the PROXY, API, or graphql mode.

How it compares

The facts provided name no paid products that this project replaces, and no comparable open-source tool either. On the evidence available, API Firewall stands alone in this registry as a schema-driven API proxy firewall.

When to use it — and when not to

A self-hoster must run the proxy container, supply and keep current an accurate OpenAPI 3.0 or GraphQL specification, and configure logging; no database, storage, or mail service is mentioned. Teams whose APIs have no OpenAPI 3.0 or GraphQL schema should not pick it, because the positive security model has nothing to enforce. The same applies to teams that cannot keep the specification in step with the deployed API, since spec drift turns legitimate traffic into blocked or logged violations, and the documented validation scope covers OpenAPI 3.0 only.

project readme (upstream, from github) — read inline

Open Source API Firewall by Wallarm

API Firewall is a high-performance proxy with API request and response validation based on OpenAPI and GraphQL schemas. It is designed to protect REST and GraphQL API endpoints in cloud-native environments. API Firewall provides API hardening with the use of a positive security model allowing calls that match a predefined API specification for requests and responses, while rejecting everything else.

The key features of API Firewall are:

Secure REST and GraphQL API endpoints by blocking malicious requests
Stop API data breaches by blocking malformed API responses
Discover Shadow API endpoints
Validate JWT access tokens for OAuth 2.0 protocol-based authentication
Denylist compromised API tokens, keys, and Cookies
AllowIPList - Restrict access to endpoints by defining a list of allowed IP addresses
Wide Range Attacks Protection: The API Firewall supports ModSecurity Rules and OWASP ModSecurity Core Rule Set

The product is open source, available at DockerHub and already got 1 billion (!!!) pulls. To support this project, you can star the repository.

Operating modes

Wallarm API Firewall offers several operating modes:

PROXY: validates HTTP requests and responses against OpenAPI 3.0 and proxies matching requests to the backend.
API: validates individual requests against OpenAPI 3.0 without further proxying.
graphql: validates HTTP and WebSocket requests against GraphQL schema and proxies matching requests to the backend.

Use cases

Running in blocking mode

Block malicious requests that do not match the specification
Block malformed API responses to stop data breaches and sensitive information exposure

Running in monitoring mode

Discover Shadow APIs and undocumented API endpoints
Log malformed requests and responses that do not match the specification

API schema validation and positive security model

When starting API Firewall, you should provide the REST or GraphQL API specification of the application to be protected with API Firewall. The started API Firewall will operate as a reverse proxy and validate whether requests and responses match the schema defined in the specification.

The traffic that does not match the schema will be logged using the STDOUT and STDERR Docker services or blocked (depending on the configured API Firewall operation mode). When operating in the logging mode on REST API, API Firewall also logs so-called shadow API endpoints, those that are not covered in API specification but respond to requests (except for endpoints returning the code 404).

API Firewall scheme

By allowing you to set the traffic requirements with the API specification, API Firewall relies on a positive security model.

Technical data

API Firewall works as a reverse proxy with a built-in OpenAPI 3.0 or GraphQL request and response validator. It is written in Golang and using fasthttp proxy. The project is optimized for extreme performance and near-zero added latency.

During the processing of incoming requests, the API Firewall recognizes a range of Content-Type header values, including:

application/json
application/xml
application/octet-stream
application/x-www-form-urlencoded
application/x-yaml
application/yaml
application/zip
multipart/form-data
text/csv
text/plain
+json structured syntax suffixes
+xml structured syntax suffixes
+yaml structured syntax suffixes
+csv structured syntax suffixes

Starting API Firewall

To download, install, and start API Firewall on Docker, refer to:

Demos

You can try API Firewall by running the demo environment that deploys an example application protected with API Firewall. There are two available demo environments:

Wallarm's blog articles related to API Firewall

Performance

When creating API Firewall, we prioritized speed and efficiency to ensure that our customers would have the fastest APIs possible. Our latest tests demonstrate that the average time required for API Firewall to process one request is 1.339 ms which is 66% faster than Nginx:

API Firewall 0.6.2 with JSON validation

$ ab -c 200 -n 10000 -p ./large.json -T application/json http://127.0.0.1:8282/test/signup

Requests per second:    13005.81 [#/sec] (mean)
Time per request:       15.378 [ms] (mean)
Time per request:       0.077 [ms] (mean, across all concurrent requests)

NGINX 1.18.0 without JSON validation

$ ab -c 200 -n 10000 -p ./large.json -T application/json http://127.0.0.1/test/signup

Requests per second:    7887.76 [#/sec] (mean)
Time per request:       25.356 [ms] (mean)
Time per request:       0.127 [ms] (mean, across all concurrent requests)

These performance results are not the only ones we have got during API Firewall testing. Other results along with the methods used to improve API Firewall performance are described in this Wallarm's blog article.

Frequently asked questions

Is api-firewall free to use?

api-firewall is open source under the MPL-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does api-firewall do?

Fast and light-weight API proxy firewall for request and response validation by OpenAPI specs.

What is api-firewall written in?

api-firewall is primarily written in Go. Its source is publicly available at https://github.com/wallarm/api-firewall, and it has 654 GitHub stars.