DEV Community

禾
禾

Posted on

How to Protect a Node.js App with a Reverse Proxy WAF

#waf #node #reverseproxy #checklist

Protecting a Node.js app with SafeLine starts with a placement decision, not a package install inside the application. The official introduction describes SafeLine as a self-hosted web application firewall that filters and monitors HTTP traffic between a web application and the internet (https://docs.waf.chaitin.com/en/home). The application guide is more specific: SafeLine is developed based on nginx, acts as an HTTP and HTTPS reverse proxy, receives traffic for the original site, cleans malicious traffic, and forwards safe traffic to the upstream application (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). Nothing in those pages documents a Node.js SDK, an Express or Fastify middleware, or a runtime hook. If the sources do not describe an integration, do not invent one. Put the firewall in front of the process you already run.

That model fits Node because a Node server is already an HTTP upstream. The app can keep its own router, body parser, and business logic. SafeLine does not need to live in the same event loop. Clients should reach the firewall first, the same way the introduction describes a reverse-proxy shield between the internet and the server.

Match the threat to the documented controls

Before changing DNS, list the traffic you actually want inspected. The introduction names defenses for SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoors, brute force, HTTP flood, and bot abuse. It also lists proactive bot-abuse defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list.

Separate feature notes matter when you choose options. Rate limiting is described as a way to throttle traffic that exceeds defined limits, including denial-of-service attempts, brute-force attempts, traffic surges, and other abuse. A CAPTCHA challenge is described as allowing human visitors while blocking crawlers and bots. An authentication challenge, when turned on, requires visitors to enter a password or be blocked. Dynamic protection, when turned on, dynamically encrypts HTML and JS from the web server on each visit.

Those are HTTP-boundary controls. They are a reasonable front door for a Node API or a server-rendered page. They are not documented as a fix for a vulnerable package inside the Node process, a broken authorization check, or a logic bug that only appears after a request is already trusted. Keep those in the application backlog.

The introduction also publishes an effect evaluation on 33,669 samples. SafeLine Balance is listed at 71.65 percent detection, 0.07 percent false positives, and 99.45 percent accuracy. SafeLine Strict is listed at 76.17 percent detection, 0.22 percent false positives, and 99.38 percent accuracy. The same table labels comparison columns for ModSecurity Level 1 and CloudFlare Free. Read that table as the vendor published sample result, not as a measurement of your routes. Strict mode has higher published detection and a higher published false-positive rate, so plan a rollback path before you enable the stricter policy on a production API.

Run the host checklist, then the application dialog

The deploy guide sets a concrete floor: Linux, x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, and at least 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must support ssse3. The guide suggests confirming architecture, Docker versions, CPU, memory, disk, and ssse3 before you install (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

The recommended automatic install is a root shell command that fetches the current manager script with an English flag. Manual install creates a data directory such as /data/safeline, downloads compose.yaml, writes .env, generates management tokens, and starts the stack with docker compose up -d. The web console is then opened at https://:9443/. The initial admin username and password are printed by docker exec safeline-mgt resetadmin. Store that password outside the Node repository.

Two deploy notes change the plan on some hosts. On ARM, the guide says to set the architecture suffix and the ARM Postgres image, and it states that SafeLine installed on ARM requires a Pro license to work properly. The Personal Edition is not supported on ARM. The LTS release line is no longer maintained starting from 9.1.0-LTS on 14 August 2025, and LTS users are strongly recommended to upgrade to the latest version.

Capacity claims in the introduction are separate from that minimum. The documentation calls SafeLine production-ready, protecting over 1,000,000 websites and handling over 30,000,000,000 HTTP requests daily. As of September 30, 2026, SafeLine surpassed 700,000 installations worldwide. SafeLine Pro annual promotional pricing is $650-$880 versus the $1,000 regular price. Use the installation milestone and the price range for planning. Use the published minimum hardware for the first host, and do not treat the global request count as a per-app sizing number.

When the console is up, add the Node service like any other site. In Applications, choose Add Application. Domain is the name, hostname, or IP clients already use. Port is the port SafeLine will listen on, such as 80 or 443, and HTTPS apps need the SSL option checked. Upstream is the real address of the Node listener. After saving, resolve the domain to the SafeLine server IP. Traffic should then enter through SafeLine and leave toward Node only from the firewall.

The missing step in many cutovers is the old listener. If the Node port remains reachable from the internet, clients can skip the proxy. The documents do not provide a Node bind setting, so close or privatize that port in your process manager, container publish rules, or security group. Also avoid a second hostname that still points straight at Node.

Test with the published cases, then watch the console

The application guide gives sample attacks to try after the site is protected: a SQL injection union-select fragment, an XSS image handler, a path traversal toward the passwd file, a code-injection string, and an XXE doctype. It says a blocking page means the attack was defended. Open the console attack list and click detail for the event. Do not stop at the browser page alone. Compare the client result with the console record before you call the cutover complete.

Turn on rate limiting, CAPTCHA, authentication challenge, or dynamic protection only after you know the route shape. Dynamic encryption is documented for HTML and JS, not as a JSON rewriter. An authentication challenge that asks every visitor for a password will break a public API even if the attack filters are correct. These pages do not document a per-framework allow list, so exceptions have to be decisions you can explain from the console controls you actually enabled.

Uninstall is also documented, and it is abrupt. From the SafeLine directory, docker compose down stops the stack, and removing the directory deletes its data. That does not remove Node, but it does remove the shield. Treat uninstall as a protection outage, not as an application rollback.

Support paths in the introduction are Discord, including feedback, FAQ, and general channels, plus GitHub issues. Use those for product behavior. Use your application tracker for bugs that remain after a request has already been forwarded upstream.

Does SafeLine document a Node.js plugin?

No. The install and application guides describe a reverse proxy, a console, and an upstream address. They do not describe an npm package or a framework middleware. Protect the app by sending clients to SafeLine and setting upstream to the Node listener.

Should Node and SafeLine share a machine?

The sources allow either layout, because upstream is simply the real address of the original app. Same-machine placement still requires that internet clients cannot bypass SafeLine and open the Node port directly.

What is different on ARM?

The deploy guide requires the ARM image settings and states that a Pro license is required for SafeLine on ARM. The Personal Edition is not supported on ARM. Promotional Pro pricing does not remove that license check.

How do I know a test was blocked?

Use the sample attack strings from the application guide, expect the documented blocking page, and confirm the event in the console attack list detail view. Check both places before calling the cutover complete.

Will dynamic protection rewrite API JSON?

The feature text says HTML and JS are dynamically encrypted on each visit when dynamic protection is turned on. These sources do not say JSON responses are encrypted. Inspect a real response before enabling it on an API-only service.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)