{
  "labDate": "2026-07-26",
  "host": {
    "docker": "29.2.0",
    "architecture": "aarch64",
    "cpus": 10,
    "memoryBytes": 8217382912
  },
  "images": {
    "upstream": {
      "reference": "mccutchen/go-httpbin:2.21.0",
      "id": "sha256:809250d14e94397f4729f617931068a9ea048231fc1a11c9e3c7cb8c28bbab8d"
    },
    "modsecurity": {
      "reference": "owasp/modsecurity-crs:4.25.0-nginx-202606290906@sha256:f2ddaaf0203f0a1d14c4cfd1ea95edb4082f5735576e40923dd8ff9e65b30687",
      "id": "sha256:f2ddaaf0203f0a1d14c4cfd1ea95edb4082f5735576e40923dd8ff9e65b30687",
      "engine": "ModSecurity 3.0.16",
      "connector": "ModSecurity-nginx 1.0.4",
      "crs": "4.25.0"
    },
    "coraza": {
      "reference": "wafwiki/coraza-caddy:2.5.0",
      "id": "sha256:decfd7324ee3f377d80e3e41b7f7db4be500c615a6ee2f80e8de8a565e909d23",
      "module": "coraza-caddy 2.5.0",
      "engine": "Coraza 3.7.0",
      "crs": "4.25.0",
      "caddy": "2.11.2"
    }
  },
  "results": [
    {
      "engine": "modsecurity",
      "case": "clean-query",
      "method": "GET",
      "path": "/get?name=alice",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.00337
    },
    {
      "engine": "modsecurity",
      "case": "sqli-query",
      "method": "GET",
      "path": "/get?id=1%20OR%201%3D1",
      "expected": 403,
      "status": 403,
      "timeSeconds": 0.003589
    },
    {
      "engine": "modsecurity",
      "case": "xss-query",
      "method": "GET",
      "path": "/get?q=%3Cscript%3Ealert(1)%3C%2Fscript%3E",
      "expected": 403,
      "status": 403,
      "timeSeconds": 0.00352
    },
    {
      "engine": "modsecurity",
      "case": "clean-json",
      "method": "POST",
      "path": "/anything",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.006084
    },
    {
      "engine": "modsecurity",
      "case": "sqli-json",
      "method": "POST",
      "path": "/anything",
      "expected": 403,
      "status": 403,
      "timeSeconds": 0.009697
    },
    {
      "engine": "modsecurity",
      "case": "xss-json",
      "method": "POST",
      "path": "/anything",
      "expected": 403,
      "status": 403,
      "timeSeconds": 0.00543
    },
    {
      "engine": "modsecurity",
      "case": "clean-email",
      "method": "GET",
      "path": "/get?email=alice%40example.com",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.005037
    },
    {
      "engine": "modsecurity",
      "case": "clean-version-path",
      "method": "GET",
      "path": "/get?path=%2Fdocs%2Fv1.2%2Fgetting-started",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.005749
    },
    {
      "engine": "modsecurity",
      "case": "clean-filter",
      "method": "GET",
      "path": "/get?filter=status%3Aopen",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.004864
    },
    {
      "engine": "modsecurity",
      "case": "clean-code-term",
      "method": "GET",
      "path": "/get?query=C%2B%2B%20templates",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.002971
    },
    {
      "engine": "coraza",
      "case": "clean-query",
      "method": "GET",
      "path": "/get?name=alice",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.002354
    },
    {
      "engine": "coraza",
      "case": "sqli-query",
      "method": "GET",
      "path": "/get?id=1%20OR%201%3D1",
      "expected": 403,
      "status": 403,
      "timeSeconds": 0.00307
    },
    {
      "engine": "coraza",
      "case": "xss-query",
      "method": "GET",
      "path": "/get?q=%3Cscript%3Ealert(1)%3C%2Fscript%3E",
      "expected": 403,
      "status": 403,
      "timeSeconds": 0.003403
    },
    {
      "engine": "coraza",
      "case": "clean-json",
      "method": "POST",
      "path": "/anything",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.002631
    },
    {
      "engine": "coraza",
      "case": "sqli-json",
      "method": "POST",
      "path": "/anything",
      "expected": 403,
      "status": 403,
      "timeSeconds": 0.002645
    },
    {
      "engine": "coraza",
      "case": "xss-json",
      "method": "POST",
      "path": "/anything",
      "expected": 403,
      "status": 403,
      "timeSeconds": 0.001779
    },
    {
      "engine": "coraza",
      "case": "clean-email",
      "method": "GET",
      "path": "/get?email=alice%40example.com",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.00163
    },
    {
      "engine": "coraza",
      "case": "clean-version-path",
      "method": "GET",
      "path": "/get?path=%2Fdocs%2Fv1.2%2Fgetting-started",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.003012
    },
    {
      "engine": "coraza",
      "case": "clean-filter",
      "method": "GET",
      "path": "/get?filter=status%3Aopen",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.001672
    },
    {
      "engine": "coraza",
      "case": "clean-code-term",
      "method": "GET",
      "path": "/get?query=C%2B%2B%20templates",
      "expected": 200,
      "status": 200,
      "timeSeconds": 0.001504
    }
  ],
  "passCount": 20,
  "totalCount": 20,
  "benchmarks": {
    "upstream": {
      "requests": 40,
      "medianMs": 0.983,
      "p95Ms": 2.172
    },
    "modsecurity": {
      "requests": 40,
      "medianMs": 3.956,
      "p95Ms": 5.518
    },
    "coraza": {
      "requests": 40,
      "medianMs": 3.571,
      "p95Ms": 4.904
    }
  },
  "resources": {
    "modsecurity": {
      "BlockIO": "0B / 471kB",
      "CPUPerc": "0.00%",
      "Container": "wafwiki-evidence-modsecurity",
      "ID": "65e4950b3492",
      "MemPerc": "0.88%",
      "MemUsage": "68.85MiB / 7.653GiB",
      "Name": "wafwiki-evidence-modsecurity",
      "NetIO": "78.1kB / 78.6kB",
      "PIDs": "11"
    },
    "coraza": {
      "BlockIO": "0B / 8.19kB",
      "CPUPerc": "0.00%",
      "Container": "wafwiki-evidence-coraza",
      "ID": "7f138814b11d",
      "MemPerc": "0.73%",
      "MemUsage": "57.2MiB / 7.653GiB",
      "Name": "wafwiki-evidence-coraza",
      "NetIO": "65.3kB / 63.8kB",
      "PIDs": "15"
    }
  },
  "limitations": [
    "Local sequential microbenchmark on Docker Desktop; not a production capacity benchmark.",
    "The request matrix covers a small set of clean, SQLi-like, and XSS-like requests against go-httpbin.",
    "Results are specific to the recorded images, rules, defaults, host resources, and localhost routing."
  ]
}