Coraza Coreruleset

March 30, 2026 · View on GitHub

Coraza Coreruleset is a Go package meant to provide the OWASP CRS in an easy and consumable way to be embedded in a Go application. Alongside the unmodified CRS ruleset, the upstream latest Coraza configuration file is also provided.

Available values for Include directives

The following values can be used in Include directives with a root filesystem that includes coreruleset.FS.

Value	Description
`@coraza.conf-recommended`	Coraza recommended base configuration
`@crs-setup.conf.example`	OWASP CRS setup configuration example
`@owasp_crs/`	OWASP CRS rules directory

Usage

In order to use CRS, you need to load the coreruleset FileSystem:

import "github.com/corazawaf/coraza-coreruleset/v4"

func main() {
    // ...
    waf, err := coraza.NewWAF(
        coraza.NewWAFConfig().
            WithDirectives("Include @owasp_crs/REQUEST-911-METHOD-ENFORCEMENT.conf").
            WithRootFS(coreruleset.FS),
    )
    // ...
}

You can also combine both CRS and your local files by combining the filesystems:

import (
    "github.com/corazawaf/coraza-coreruleset/v4"
    "github.com/jcchavezs/mergefs"
    "github.com/jcchavezs/mergefs/io"
 )

// ...

func main() {
    // ...
    waf, err := coraza.NewWAF(
        coraza.NewWAFConfig().
            WithDirectives(`
                Include @owasp_crs/REQUEST-911-METHOD-ENFORCEMENT.conf
                Include my/local/rule.conf
            `).
            WithRootFS(mergefs.Merge(coreruleset.FS, io.OSFS)),
    )
    // ...
}

How to update to a newer CRS and Coraza config version

Update the crsVersion and corazaVersion constants in version.go with the wished CRS and Coraza commit SHA or tags.
Run go run mage.go downloadDeps.
Double check the changes made under the /rules and /tests directories.
Commit your changes.