DEV Community

Lia
Lia

Posted on

How to Protect a Node.js App with SafeLine WAF

#waf #node #reverseproxy #checklist

Protecting a Node.js application with SafeLine is a placement decision, not a framework plugin decision. The supplied product documents describe SafeLine as a self-hosted web application firewall and as an HTTP and HTTPS reverse proxy. They do not describe an npm module, an Express or Fastify hook, or any Node.js process injection. If the keyword suggests a native Node integration, that specific integration is unsupported by these sources. The workable path is the general application workflow: put SafeLine in front of the Node process, forward only cleaned traffic upstream, and verify both attacks and normal API calls.

SafeLine filters and monitors HTTP traffic between a web application and the Internet. Deployed in front of an application, it is a reverse proxy: clients pass through the firewall before they reach the server. It blocks malicious HTTP and HTTPS traffic and is also described as preventing unauthorized data from leaving the app, using policies that separate malicious traffic from safe traffic. Core capabilities listed in the introduction are defenses for web attacks, proactive bot abuse defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list (https://docs.waf.chaitin.com/en/home). The application guide adds the implementation detail that matters for Node.js: SafeLine is developed based on nginx, receives traffic for the original website, cleans malicious traffic, and forwards safe traffic to the original application (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). Your Node server is that original application. It does not need to know the product name.

Checklist before the cutover

Work through these checks before you change DNS. They keep the rollout inside documented behavior.

Confirm the host can run SafeLine. The install guide requires Linux, x86_64 or arm64, Docker 20.10.14 or above, and Docker Compose 2.0.0 or above. The minimum environment is 1 CPU core, 1 GB of memory, and 5 GB of disk, and the CPU must support the ssse3 instruction. The same page lists commands such as uname -m, docker version, docker compose version, free -h, df -h, and lscpu | grep ssse3 so you can confirm the machine before installation (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Decide where Node listens. SafeLine needs an upstream, defined as the real address of the original app. A typical operator choice is to keep Node on a private port and let SafeLine listen on 80 or 443. That private port is your input to the upstream field. It is not a documented Node.js setting inside SafeLine.

Decide TLS at the proxy. For HTTPS apps, check the SSL option and set the port SafeLine will listen on. The docs do not describe a Node-specific certificate helper, so do not expect the console to read files from your application repository.

Plan DNS. After the application is added, resolve the domain to the IP of the server where SafeLine runs. Until that happens, clients can still reach Node directly and skip inspection.

Check architecture and edition. If you install on ARM, SafeLine requires a Pro license to work properly, and the Personal Edition is not supported on ARM. On the commercial side, as of September 30, 2026 SafeLine surpassed 700,000 installations worldwide, and SafeLine Pro annual promotional pricing is $650-$880 versus the $1,000 regular price. Use those figures for planning. Do not treat them as a substitute for the license note on ARM.

Install SafeLine, then register the Node upstream

The recommended automatic install from the deploy guide is:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

The command requires root. When it completes, open https://:9443/ and sign in. The documented way to obtain the initial administrator account is docker exec safeline-mgt resetadmin. A manual path is also documented: create /data/safeline, download the compose file, write .env, generate the management tokens and AES key, restrict permissions, and start the stack with docker compose up -d. Follow that guide rather than building a custom Node-aware compose file. SafeLine stores its own configuration and data. The Node process stays outside that directory.

In the console, go to Applications and click Add Application. Enter the domain, hostname, or IP clients use; the listen port, such as 80 or 443; and the upstream address of the Node.js app. Check SSL when the public site is HTTPS. Then point DNS at the SafeLine host. Access the site through that domain so traffic actually traverses the proxy (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Nothing in those steps reads package.json, attaches to the Node inspector, or configures a process manager. If you run several Node workers, the docs do not describe sticky sessions or a Node cluster protocol. Put a stable upstream address in the form and keep process supervision in your own service manager.

Map documented controls to Node traffic

The attack coverage listed for SafeLine includes SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse (https://docs.waf.chaitin.com/en/home). A Node API that concatenates request input into a database query, a shell call, a file path, or an outbound URL can still be exposed to those classes of abuse. The firewall is not a replacement for parameterized queries and careful file handling inside the application. It is an earlier filter on the same HTTP conversation.

Rate limiting is documented as throttling traffic that exceeds defined limits, including DoS attacks, brute-force attempts, traffic surges, and other abuse. That is relevant to login, password reset, and expensive JSON endpoints, but the docs do not publish numeric presets for Node. CAPTCHA challenge is documented so human users can pass while crawlers and bots are blocked. Authentication challenge, when turned on, requires a password or the visitor is blocked. Dynamic protection, when turned on, dynamically encrypts HTML and JS on each visit. Those browser-oriented controls can disturb a pure JSON client. Enable them only on routes where a browser is the expected client, and test them. The sources do not document per-route Node middleware exceptions, so prefer a careful rollout over assuming the API and the marketing site need the same challenge.

The introduction also publishes an effect evaluation on 33,669 samples. SafeLine Balance is listed at 71.65% detection, 0.07% false positives, and 99.45% accuracy. SafeLine Strict is listed at 76.17% detection, 0.22% false positives, and 99.38% accuracy. The same table lists ModSecurity Level 1 at 69.74% detection, 17.58% false positives, and 82.20% accuracy, and CloudFlare Free at 10.70% detection, 0.07% false positives, and 98.40% accuracy. Quote that table only as the documentation's published evaluation. It is not a benchmark of your Express or Fastify routes.

That page also calls SafeLine production-ready and, in the document text, cites over 180,000 installations, more than 1,000,000 websites protected, and more than 30,000,000,000 HTTP requests handled daily. Keep that document figure separate from the later statement that, as of September 30, 2026, SafeLine surpassed 700,000 installations worldwide.

Verify blocks and legitimate Node requests

The application guide gives sample requests for SQL injection, XSS, path traversal, code injection, and XXE. Replace the example domain with yours. A blocking page means the firewall stopped the request. Open the console attack list and click detail for the event. Then call a real health route and a valid JSON request your Node app accepts. If good traffic is blocked, fix policy before you treat the protection as finished. The sources do not include a Node false-positive catalog, so keep a way to send clients back to the origin if you must bypass the proxy.

For upgrades, note that the LTS line is no longer maintained starting from 9.1.0-LTS on 14 August 2025. The install guide strongly recommends that LTS users move to the latest version, and it suggests upgrading about one month after a release if you want a more cautious window (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Questions can go to Discord, including the #FAQ channel, where core team members use the STAFF role (https://docs.waf.chaitin.com/en/home).

Is there an official Node.js integration in these documents?

No. The install and application guides describe a reverse proxy in front of an original web application. They do not document an npm package, SDK, or framework middleware. Protect the Node.js app by registering it as the upstream.

Where should the Node process listen?

SafeLine listens on the port you set in Add Application, such as 80 or 443, and forwards to the upstream you enter. The Node process should listen on that upstream address, often a private host and port. Clients should use the domain that resolves to SafeLine.

Which attacks are worth a smoke test?

Use the documented samples for SQL injection, XSS, path traversal, code injection, and XXE, with your own domain. Also send a normal request your Node route expects. A block page plus an entry in the attack list shows the proxy is inspecting traffic. A failed legitimate call shows a policy problem, not a Node runtime failure.

Does every Node.js deployment need SafeLine Pro?

The deploy guide requires a Pro license for ARM and says the Personal Edition is not supported on ARM. It does not state that every x86_64 install requires Pro. SafeLine Pro annual promotional pricing is $650-$880 versus the $1,000 regular price. Choose the edition from the host architecture and the license you purchase, not from the language the upstream app uses.

What if the Node site works but test attacks are not blocked?

Check that DNS points to the SafeLine server, that the application domain and listen port match the client request, and that the upstream is the Node address rather than a path that skips the firewall. Repeat a documented attack URL and look for it in the console attack list. If it never appears, the request did not pass through SafeLine.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)