I'm considering various layouts to expose various HTTP API services (running on their own differents servers) through a frontend server dedicated to manage permissions on behalf of the API services.
I've considered various options, from the classical ones like Nginx, Apache, etc. to HAProxy, passing by the various Python webserver solutions like Tornado, Twisted (which gives me the opportunity to implement my own ACL system easily). The foundamental feature is high performance and scalability, and the ability to manage fine grained ACL rules (similar to the HAProxy ACL system)
I would like to know what is a suggested approach to setup what I need, and if (opne source) ready-to-use solutions are already available dedicated to this.
(I'm the user that asked the question). thanks for both the answers. I've just discovered the features of mod_security. I'm going to read the Book. I wasn't sure that WAF were the right tools, but I think it is ;)
The only problem I fear to face is the need of a server restart when I apply chnges to the rules. I hope it isn't required.
HAProxy seems ok, but I prefer something crossplatform. I will give both the solutions a try.