AIWAF for Node.js

Current Node source and framework support

The current release is aiwaf 1.1.5 with the declared aiwaf-wasm ^0.2.5 dependency. Publish the matching WASM companion first. The native request engine still requires explicit registration and awaits initialization; a missing native API fails startup. Legacy adapters keep their separate configuration and execution path.

Offline training now uses WASM receipts to prevent handled historical requests from extending or recreating blocks after expiry or manual removal. Models still fit on history; enforcement uses fresh requests. Preserve node_training_evidence.json in the blocklist data directory, or set AIWAF_TRAINING_STATE_DIR to a durable shared directory. Invalid timestamps are excluded. Missing WASM APIs, corrupt receipts, and storage failures make training fail visibly. A crashed trainer can leave node_training_evidence.lock; confirm it has stopped before removing that lock directory. Block and receipt writes are separate, so a crash between them can require recovery.

The current reference tests use Node 22.18.0, Express 4, Fastify 5, and NestJS 11. These are tested configurations, not a claim that every framework version is supported. Use the framework and adapter matching your application. Next.js examples require Node API request/response objects; Edge middleware is not supported by this adapter.

Legacy blocklist request checks and listing are read-only. Explicit database cleanup checks expiry in the DELETE statement; CSV cleanup reads current rows under the same cross-process lock used by blocklist writes. A crash can leave <blocklist CSV path>.lock; confirm its writer has stopped before removing that directory. Lock acquisition fails after 60 seconds. Restart all old writers when upgrading. These fixes do not make the explicit native engine's per-worker state distributed.

For source development, use the committed lockfile with npm ci, run the coverage and real native checks, and audit the complete tree with npm audit. Read dependency versions and verification and native migration.

const express = require('express');
const aiwaf = require('aiwaf');

const app = express();
app.use(express.json());

app.use(aiwaf({
  AIWAF_MIDDLEWARES: ['auto'],
  staticKeywords: ['.php', '.env', '.git'],
  WINDOW_SEC: 10,
  MAX_REQ: 20,
  FLOOD_REQ: 40,
  AIWAF_HEADER_VALIDATION: true,
  AIWAF_METHOD_POLICY_ENABLED: true,
  AIWAF_ALLOWED_METHODS: ['GET', 'POST', 'HEAD', 'OPTIONS']
}));

app.get('/', (req, res) => res.json({ protected: true }));
app.listen(3000);

app.use(aiwaf({
  AIWAF_PATH_RULES: [
    { PREFIX: '/health/', DISABLE: ['header_validation', 'rate_limit'] },
    { PREFIX: '/api/public/', RATE_LIMIT: { WINDOW: 60, MAX: 300 } }
  ]
}));

aiwaf.generateExpressManifest(app, '.aiwaf/paths.json');

cd js
npm run aiwaf -- manifest --framework express --routes routes.json --output .aiwaf/paths.json