Module configuration

We provide the ability to configure the Next-Gen WAF module. The following attributes are set by default, but may need to be modified to provide support for different environments. In the majority of cases modifying module configuration is not necessary. Contact support if you need assistance or have questions regarding modifying module configuration.

Apache

To modify the Next-Gen WAF module configuration in Apache you will need to add directives to your Apache configuration file (e.g., for CentOS it is httpd.conf, for Debian or Ubuntu it is apache.conf or apache2.conf). Note, these directives must be set after the Next-Gen WAF module is loaded.

Starting with release 1.6.0, the following directives replace any earlier ones. These directives are a renaming of the earlier ones but with the addition of the prefix SigSci.

The following directives will be deprecated in favor of the new ones above with the SigSci prefix but are backwards compatible and will continue to work.

The following directives are deprecated and will be ignored.

Conditional Inspection Example

The Next-Gen WAF Apache Module can perform conditional inspection per VirtualHost by either disabling or enabling the module globally. This is useful for configurations that only require inspection to be performed, or not performed, on specific request conditions (e.g., path).

To enable or disable the module globally add both the SigSciAgentInspection and SigSciEnableFixups directives to the global Apache configuration (httpd.conf, apache2.conf). For example to disable the Next-Gen WAF Apache Module globally, but enable inspection for a specific `VirtualHost``:

SigSciAgentInspection Off
SigSciEnableFixups On

Inside each corresponding VirtualHost, add the appropriate SigSciAgentInspection directive value. For example, to enable inspection with only the VirtualHost handling requests for example.com:

1
2
3
4
5
6

<VirtualHost *:80>
    DocumentRoot "/www/example1"
    ServerName example.com
    ServerAlias www.example.com
    SigSciAgentInspection On
</VirtualHost>

After restarting the appropriate Apache service, the module will log the following output to the Apache error log with the appropriate values (1 for enabled, 0 for disabled) for each directive enabling or disabling the module applied in configuration:

[Fri Dec 12 11:56:31.329363 2025] [signalsciences:notice] [pid 3439:tid 123749635139456] SigSci: config: agent inspection flag: 0
[Fri Dec 12 11:56:31.329363 2025] [signalsciences:notice] [pid 3439:tid 123749635139456] SigSci: config: agent inspection flag: 1

NGINX dynamic module

Refer to Installing the NGINX dynamic module for instructions on installing and configuring the NGINX dynamic module.

NGINX Lua Module

To modify the Next-Gen WAF Lua module for NGINX, changes can be made in the Next-Gen WAF Lua script, which by default is at /opt/sigsci/nginx/sigsci.conf.

Example configuration

1
2
3
4

sigsci.agenthost = "unix:/var/run/sigsci.sock"
sigsci.agentport = 12345
sigsci.timeout = 100
sigsci.maxpost = 1000000

HAProxy

Configuration changes are typically not required for the HAProxy module to work. However, it is possible to override the default settings if needed. To do so, you must create an override.lua file in which to add these configuration directives. Then, update the global section of your HAProxy config file (/usr/local/etc/haproxy/haproxy.cfg) to load this over-ride config file.

Example of configuration

1
2
3
4

global
   ...
   lua-load /path/to/override.lua
   ...

Over-ride Directives

These directives may be used in your over-ride config file.

Example of over-ride configuration

1
2
3

sigsci.agenthost = "192.0.2.243"
sigsci.agentport = 9090
sigsci.extra_blocking_resp_hdr = "Access-Control-Allow-Origin: https://example.com"

IIS

You can set the configuration for the IIS module using the MSI installer, the SigsciCtl.exe utility in v2.0.0+, IIS Manager UI, PowerShell, or the appcmd.exe utility. See Configuration Usage for more information on configuring the IIS module.

Language Modules

See language specific module pages for configuration details.

• Java
  • As a Servlet filter
  • As a Jetty handler
  • As a Netty handler
  • With Dropwizard
  • On WebLogic servers
• Node.js
• .NET