waf_helper

WAF Helper sets a secure, HMAC-based cookie for authorized users so that ModSecurity (or any other WAF) can selectively relax rules on endpoints that trigger false positives — such as admin forms, layout builders, or content-editing routes — without weakening protection for the rest of the site.

The problem

Web Application Firewalls like ModSecurity with the OWASP Core Rule Set are essential for production sites, but their strict rules often flag legitimate Drupal admin actions (rich-text editing, layout building, REST API calls) as attacks. The common workaround — blanket rule exclusions — leaves the entire application exposed.

What this module does

1. Issues a per-user HMAC cookie (HMAC-SHA256 of the user's UUID + a configurable salt, keyed with Drupal's private key) to users who hold the "Bypass ModSecurity WAF" permission.
2. Validates the cookie on every request using a timing-safe comparison and automatically removes invalid or tampered cookies.
3. Lets your WAF rules inspect the cookie to selectively lower the paranoia level or disable specific rules only for trusted sessions on targeted paths.

The module itself does not modify any WAF rules — it provides the trusted signal your WAF configuration can act on.

Features

• Configurable cookie name, salt, and lifetime.
• Secure defaults: HttpOnly, Secure, SameSite=Strict.
• Extensible via hook_waf_helper_cookie_value_alter().

Requirements

• Drupal 10 or 11
• A WAF (e.g. ModSecurity + OWASP CRS) with the ability to inspect cookies in rule conditions