Is kong community edition can eliminate SQL injections & OWASP threats

[sraravet]

Hi

i am using kong community edition 2.0.3(db-less) , do we have any plugins or procedure to remove below threats

1. SQL injections
   2)OWASP top 10 threats

Thanks in advance

[jeremyjpj0916]

Its possible, we have done so and I give a few notes here on how:

ModSec v3+OWASP CRS3 On Kong Discussion/Guide

Just started dabbling in running Kong with ModSecurity v3 with the Nginx connector and the OWASP CRS3. Figured I would throw together some snippets of code that may help folks out that want to play around with WAF embedded in their own Kong deployments. First, the code. Note I am building via a docker file with base image Alpine, running Kong 1.4.3 right now. Some dependencies you may need(not all relate to the WAF but 3-4 of these do). RUN apk add --no-cache --virtual build-deps wget tar ca…

Disclaimer is that its performance isn’t the best and your throughput will be capped pretty hard through waf enabled traffic. I am actively looking for alternative open source solution/codebase to leverage down the road .

[sraravet]

Hi

Thanks for your reply, but currently i am using kong 2.0.3 version with db less. will above changes can be applied in my kong?

when i went through this link it says kong1.4.3?

Please let me know

Thanks In advance

[jeremyjpj0916]

Yep, still feasible on later versions too. Still nginx webserver after all.

[sraravet]

Hi ,

i have tried above implementation but getting the below error while building docker image

Step 22/42 : COPY kong-ngx-build openresty-build-tools/kong-ngx-build

COPY failed: stat /var/lib/docker/tmp/docker-builder073257003/kong-ngx-build: no such file or directory

can you please help me to resolve this.?

what is the exact path i can copy kong-nginx build