Getting started with AIWAF
Source and package versions
One AIWAF repository.
Python: py/aiwaf/ · Node.js: js/ · Rust/WASM: rust/ · Java: java/.
Source and canonical README.
Versions shown describe the source checkout; package releases are independent.
Current Python/Node source targets are aiwaf 1.1.8 (Python) and
aiwaf 1.1.5 (npm), with Rust/Python 0.2.7 and
WASM 0.2.5 and Java 1.3.5. Sandbox guides retain their separately pinned builds.
Build a small protected application, see an enforced request boundary, and then learn how middleware, route policy, state, and training fit together.
Start with a complete application
The first-app tutorial uses Flask so every file and command can be shown in full. It needs Python and a terminal; it does not assume an existing project, Redis service or trained model. Python 1.1.4 installs its required Rust runtime.
- Prepare your environment — create a workspace and install the Flask extra.
- Create your application — understand app.py, registration, and the generated files.
- Discover live routes — use module:object imports and inspect the manifest.
- Verify a rate limit — observe three 200 responses and a fourth 429.
- Add a route policy — exempt one check on one endpoint.
- Inspect logs and plan training — distinguish observations, counters, and models.
Integrate an existing application
Each framework guide identifies its prerequisites, the file to edit, the adapter's registration point, the run command, and what to inspect. Use the guide for your framework rather than translating option names between runtimes.
| Runtime | Framework guides | Configuration surface |
|---|---|---|
| Python | Flask, Django, FastAPI | Flask app.config; Django settings.py; FastAPI nested options |
| Node.js | Express, Fastify, Hapi, Koa, NestJS, Next.js API routes, AdonisJS, Sails | Adapter options and normalized aliases |
| Java | Spring, Jakarta Servlet | Typed fields, JSON/environment settings, Spring properties |
| Rust/WASM | Primitive bindings | Host adapter configuration and primitive API arguments |
Understand what happens to a request
System architecture follows the adapter, policy selection, deterministic controls, runtime state, response observations, and offline training. Continue with Python, Node, Java, or Rust/WASM internals for implementation boundaries.
Look up a specific task
- Configuration reference: settings, types, source defaults, precedence, and shared state.
- Upgrade guide: package rename, reputation state, manifests, and models.
- Troubleshooting: rejected imports, missing routes, unexpected blocks, and training inputs.
- API entry points: runtime APIs and the distinction from website administration.
Choose packages deliberately
Python and npm both use the name aiwaf. The required Rust runtime for Python 1.1.4 is aiwaf-rust; WebAssembly primitives are aiwaf-wasm. Java builds under java/ in the same monorepo. See the source-version matrix and installed package metadata before choosing a release. PHP pages are legacy reference.