Version: v2.2.4
Author: Abhishek Yadav
Project Type: Cybersecurity Research & Defensive Security Engineering Platform
License: Apache License 2.0
Primary Technologies: Go, PostgreSQL, Redis, Coraza WAF, WebSockets, Docker, Kubernetes

Abstract

Obsidian Sentinel is a modular and extensible Web Application Firewall (WAF) platform engineered to provide layered protection against modern HTTP-based cyber threats targeting web applications, APIs, and distributed application environments. The project combines the Coraza WAF engine with a custom defensive security architecture that integrates real-time request inspection, distributed rate limiting, threat intelligence correlation, GeoIP-based filtering, JWT authentication, structured audit logging, operational analytics, and infrastructure-aware deployment capabilities.

The primary objective of the project is to demonstrate how modern defensive security controls can be integrated into a lightweight, operationally deployable, and observability-focused WAF architecture while maintaining flexibility for research, experimentation, and enterprise-style deployment scenarios.

Obsidian Sentinel was developed as an applied cybersecurity engineering initiative focused on practical implementation rather than theoretical modeling alone. The system emphasizes layered security enforcement, operational visibility, deployment portability, secure middleware design, and defensive telemetry collection.

The platform is capable of detecting, filtering, and mitigating multiple classes of Layer 7 web attacks including SQL Injection (SQLi), Cross-Site Scripting (XSS), Remote Code Execution (RCE), Local and Remote File Inclusion (LFI/RFI), XML External Entity attacks (XXE), Server-Side Request Forgery (SSRF), Server-Side Template Injection (SSTI), LDAP injection, session abuse, malicious payload delivery attempts, and reconnaissance-based attack activity.

In addition to request filtering capabilities, the system also integrates operational security mechanisms such as real-time dashboards, structured audit trails, threat feed synchronization, distributed caching, security event monitoring, webhook-based alerting, request tracing, and deployment automation workflows.

Obsidian Sentinel is intended for educational research, defensive security experimentation, application security studies, DevSecOps workflows, infrastructure security testing, and secure middleware engineering exploration.

Introduction

Modern web applications operate in increasingly hostile environments where automated attack traffic, credential abuse, injection attacks, reconnaissance activity, and API-focused exploitation attempts are continuously evolving. Traditional perimeter defenses alone are often insufficient against sophisticated application-layer attacks targeting modern distributed systems.

Web Application Firewalls represent a critical component of application-layer defense by providing inspection, filtering, monitoring, and policy enforcement capabilities directly within HTTP request-processing pipelines.

However, many lightweight WAF implementations focus exclusively on signature matching while lacking:

• deployment flexibility,

• operational telemetry,

• distributed rate limiting,

• infrastructure integration,

• observability,

• modern authentication workflows,

• real-time monitoring,

• and extensibility for modern deployment environments.

Obsidian Sentinel was designed to address these limitations through a modular architecture capable of combining traditional WAF inspection with operational security controls and infrastructure-aware defensive mechanisms.

The project explores the integration of:

• middleware-based security processing,

• distributed request management,

• threat intelligence correlation,

• authentication-aware access control,

• telemetry-driven monitoring,

• and containerized deployment workflows.

The platform was engineered with emphasis on:

• maintainability,

• modular defensive design,

• extensibility,

• runtime observability,

• deployment portability,

• and layered security enforcement.

Research Objectives

The development of Obsidian Sentinel was guided by the following objectives:

1. Design a modular Web Application Firewall architecture capable of integrating multiple defensive security controls.

2. Demonstrate practical implementation of application-layer threat mitigation techniques using modern open-source tooling.

3. Explore the integration of distributed rate limiting, threat intelligence feeds, and GeoIP filtering within a unified defensive platform.

4. Develop a deployment-flexible system capable of operating in standalone, containerized, and orchestrated environments.

5. Provide real-time monitoring, telemetry collection, and audit visibility for defensive security operations.

6. Create a platform suitable for educational cybersecurity research, defensive experimentation, and application security learning.

7. Investigate practical methods for integrating infrastructure-aware security controls into modern HTTP middleware pipelines.

System Overview

Obsidian Sentinel operates as a layered HTTP security processing platform that evaluates incoming requests through multiple security stages before requests reach application handlers.

The system combines:

• WAF inspection,

• request validation,

• authentication enforcement,

• threat intelligence evaluation,

• distributed rate limiting,

• GeoIP analysis,

• security telemetry,

• and audit logging.

The platform architecture follows a defense-in-depth model where multiple security layers operate together to reduce attack surface exposure and improve detection capability.

Core architectural principles include:

• modular middleware processing,

• concurrency-safe request handling,

• observability-first engineering,

• scalable deployment compatibility,

• and infrastructure portability.

Architecture Overview

The request-processing pipeline consists of several coordinated security layers:

┌─────────────────────────────┐
│                        Client Request                             │
└─────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────┐
│                   Security Headers Middleware                                 │
│         (CSP, X-Frame-Options, X-Content-Type-Options)          │
└──────────────────────────────────────┘
                                │
                                ▼
┌───────────────────────────────┐
│                     Rate Limiter Middleware                     │
│              (Sliding Window, Per-IP Tracking)              │
└───────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────┐
│                    Threat Intelligence Check                                      │
│         (Spamhaus DROP, Emerging Threats, Custom Lists)        │
└──────────────────────────────────────┘
                                │
                                ▼
┌───────────────────────────────┐
│                      Coraza WAF Engine                           │
│                  (55+ ModSecurity Rules)                       │
└───────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────┐
│                     Application Router                           │
│               (API Handlers, Static Files)                      │
└──────────────────────────────┘

Each processing layer contributes independently to defensive enforcement while maintaining modular separation for maintainability and extensibility.

The architecture is designed to support:

• low-latency request handling,

• distributed deployments,

• scalable observability,

• configurable security policies,

• and flexible middleware composition.

Core Security Features

Web Application Firewall Engine

The platform integrates the Coraza WAF engine to provide request inspection and rule-based attack detection.

The WAF subsystem supports:

• ModSecurity-compatible rule processing,

• request body inspection,

• header validation,

• payload analysis,

• anomaly scoring,

• and configurable enforcement behavior.

Attack detection coverage includes:

• Cross-Site Scripting (XSS),

• SQL Injection (SQLi),

• Remote Code Execution (RCE),

• Local File Inclusion (LFI),

• Remote File Inclusion (RFI),

• Server-Side Request Forgery (SSRF),

• XML External Entity (XXE),

• Server-Side Template Injection (SSTI),

• LDAP injection,

• deserialization attacks,

• session abuse patterns,

• and malicious payload delivery attempts.

Authentication & Access Control

Obsidian Sentinel implements JWT-based authentication using HMAC-SHA256 token signing.

Authentication capabilities include:

• configurable token expiration,

• refresh token workflows,

• secure secret management,

• constant-time signature validation,

• role-based authorization,

• and session-aware request validation.

The RBAC model supports:

• Administrative access,

• Security Analyst access,

• and Read-Only Viewer access.

This separation enables operational role segmentation and controlled administrative functionality.

Distributed Rate Limiting

The platform includes a concurrency-safe distributed rate limiting engine designed to reduce abusive request behavior and automated attack traffic.

Key characteristics include:

• 256-shard visitor tracking,

• sliding-window request evaluation,

• Redis-backed distributed synchronization,

• per-IP enforcement,

• endpoint-aware limits,

• and configurable threshold management.

Rate limiting controls are intended to mitigate:

• brute-force authentication attacks,

• API abuse,

• automated scanning,

• reconnaissance traffic,

• and denial-of-service style request flooding.

Threat Intelligence Integration

Obsidian Sentinel integrates external threat intelligence feeds to improve request risk evaluation.

Supported sources include:

• Spamhaus DROP/EDROP,

• Emerging Threats,

• FireHOL Level 1,

• and custom blocklist feeds.

Threat intelligence processing enables:

• malicious IP identification,

• network reputation analysis,

• known threat correlation,

• automated blocklist synchronization,

• and high-risk request evaluation.

Threat feeds are periodically refreshed to maintain updated threat visibility.

GeoIP Security Controls

The platform supports geographic request analysis using MaxMind GeoIP integration.

GeoIP functionality includes:

• country-based filtering,

• geographic request classification,

• risk-aware request evaluation,

• custom region blocking,

• VPN and proxy identification,

• and configurable geographic access policies.

These capabilities allow deployment-specific regional security enforcement.

Real-Time Monitoring & Observability

Operational visibility is a major design objective of the platform.

The system includes:

• WebSocket-powered real-time dashboards,

• request telemetry visualization,

• structured audit logging,

• metrics aggregation,

• Prometheus-compatible endpoints,

• and operational analytics.

Telemetry collection includes:

• request statistics,

• attack detection events,

• rate limiting activity,

• geographic request distribution,

• threat intelligence matches,

• and system health metrics.

Audit Logging & Security Telemetry

Obsidian Sentinel supports PostgreSQL-backed audit logging for long-term event storage and security analysis.

Audit capabilities include:

• request event tracking,

• security violation recording,

• authentication logging,

• administrative activity tracking,

• request tracing,

• and incident investigation support.

Structured logging improves:

• forensic analysis,

• operational visibility,

• incident response workflows,

• and security monitoring integration.

Webhook Alerting System

The platform includes webhook-based alerting integrations for external notification workflows.

Supported integrations include:

• Slack,

• Microsoft Teams,

• Discord,

• and PagerDuty.

Alerting mechanisms support:

• severity-based routing,

• security event notifications,

• operational monitoring,

• and incident escalation workflows.

Deployment & Infrastructure Support

Obsidian Sentinel was designed with deployment flexibility as a primary architectural objective.

The platform supports:

• native Go execution,

• standalone binary deployment,

• Docker-based containerization,

• Docker Compose orchestration,

• Kubernetes deployments,

• and Linux systemd service integration.

Infrastructure capabilities include:

• environment-based configuration,

• secret-driven deployment,

• health probes,

• metrics endpoints,

• scalable container execution,

• and CI/CD integration workflows.

The project also includes automated GitHub Actions workflows for:

• testing,

• artifact generation,

• release automation,

• Docker image publication,

• and software bill of materials (SBOM) generation.

Security Model

The platform follows a layered defense model combining multiple independent security mechanisms.

Security enforcement components include:

• request filtering,

• payload inspection,

• access control,

• rate limiting,

• threat intelligence correlation,

• geographic restriction,

• and audit visibility.

The security design emphasizes:

• secure defaults,

• configurable enforcement,

• modular policy composition,

• and infrastructure-aware protection.

Security headers supported include:

• Content Security Policy (CSP),

• HTTP Strict Transport Security (HSTS),

• X-Frame-Options,

• X-Content-Type-Options,

• and Referrer Policy controls.

Research & Educational Significance

Obsidian Sentinel was developed as an applied cybersecurity engineering initiative focused on practical implementation of modern defensive security concepts.

The project demonstrates real-world integration of:

• Web Application Firewall technologies,

• distributed middleware design,

• secure authentication workflows,

• infrastructure security practices,

• observability engineering,

• DevSecOps deployment methodologies,

• and operational monitoring systems.

The platform is intended to support:

• cybersecurity learning,

• defensive security experimentation,

• application security research,

• middleware security analysis,

• and practical infrastructure security studies.

The implementation provides educational value for:

• Computer Science students,

• cybersecurity researchers,

• defensive security practitioners,

• DevSecOps engineers,

• and application security learners.

Limitations

While the platform provides layered defensive capabilities, several limitations remain inherent to WAF-based systems.

Limitations include:

• potential false positives under aggressive rule configurations,

• encrypted traffic inspection limitations without TLS termination,

• dependency on external threat intelligence feed quality,

• evolving attack evasion techniques,

• and performance trade-offs under deep inspection workloads.

The project does not attempt to replace:

• endpoint protection platforms,

• network intrusion detection systems,

• or full-scale SIEM environments.

Instead, the platform is intended as an application-layer defensive component within broader security architectures.

Future Work

Potential future enhancements include:

• machine learning-assisted anomaly detection,

• adaptive behavioral analysis,

• automated rule generation,

• distributed threat intelligence federation,

• API schema-aware validation,

• advanced GraphQL inspection,

• and enhanced telemetry correlation.

Additional research opportunities include:

• performance benchmarking,

• latency optimization,

• false-positive reduction strategies,

• and comparative analysis against alternative WAF architectures.

Repository & Source Code

GitHub Repository:
https://github.com/Abhishek-yadav04/Obsidian

The repository includes:

• source code,

• deployment configurations,

• CI/CD workflows,

• documentation,

• test suites,

• and infrastructure deployment resources.

Acknowledgments

Obsidian Sentinel builds upon contributions from the broader open-source security ecosystem.

The project draws inspiration from:

• Coraza WAF,

• OWASP Core Rule Set (CRS),

• ModSecurity rule processing concepts,

• and modern application security engineering practices.

Special thanks to the Coraza maintainers and contributors for their work advancing open-source web application security technologies.

Author

Abhishek Yadav
Computer Science Student
Cybersecurity Research & Defensive Security Engineering

Citation

Yadav, A. (2026). Obsidian Sentinel: A Modular Web Application Firewall for HTTP Threat Mitigation (v2.2.4). Zenodo.