First protected app / Step 2 of 6

Create your first protected app

In the directory you prepared, create a file named app.py. This is a complete application. You can copy the whole block without filling in missing routes or configuration.

1. Create app.py

app.py

"""Local learning app. Its small limits are for the tutorial, not production."""

from flask import Flask
from aiwaf.flask import AIWAF, aiwaf_exempt

app = Flask(__name__)
app.config.update(
    AIWAF_USE_CSV=True,
    AIWAF_DATA_DIR="aiwaf_data",
    AIWAF_RATE_WINDOW=60,
    AIWAF_RATE_MAX=3,
    AIWAF_RATE_FLOOD=100,
    AIWAF_PATH_RULES=[
        {"PREFIX": "/api/message", "RATE_LIMIT": {"WINDOW": 60, "MAX": 3, "FLOOD": 100}},
    ],
    AIWAF_LOG_DIR="aiwaf_logs",
    AIWAF_LOG_FORMAT="json",
)


@app.get("/api/message")
def message():
    return {"message": "Hello from a protected route"}


@app.get("/health")
@aiwaf_exempt
def health():
    return {"ok": True}


AIWAF(app, middlewares=["rate_limit", "logging"])

2. Understand the pieces

• Flask(__name__) creates the application object. It is named app, so both Flask and the AIWAF CLI will use the import target app:app.
• app.config.update(...) applies settings before middleware registration. The teaching limit is three requests in 60 seconds; the flood threshold is intentionally higher so the rate-limit demonstration does not create a flood block.
• AIWAF_PATH_RULES pins the message route to the teaching budget. Generated manifests can supply inferred rate settings; the explicit rule keeps this exercise at three requests.
• /api/message is the protected route. The handler runs only when the selected middleware allows the request.
• @aiwaf_exempt marks /health as exempt from protection. Use this deliberately for liveness; it does not turn off checks for other routes.
• AIWAF(...) registers rate limiting and logging after the routes have been defined. Header, keyword, geo, and anomaly checks are not selected in this teaching app, making the first verification predictable with a plain HTTP client.

3. Start the development server

python -m flask --app app:app run --port 5000

The console should report a development server listening at http://127.0.0.1:5000. Leave that terminal open. Flask's development server is suitable for this local exercise; choose your framework's production server before deployment.

4. Recognize the generated files

aiwaf-demo/
  app.py
  .venv/
  aiwaf_logs/        # request logs
  aiwaf_data/        # CSV state when a store needs it
  .aiwaf/           # route manifest after the next step

Runtime directories are created as they are needed. Keep the application source in Git; ignore the virtual environment, request logs, local state, and generated route manifest.