Howdah 1.1 is released. Where 1.0 finished the first layer — refusing abusive request shapes before they exhaust memory — 1.1 opens the second: Howdah now looks at the content of what comes in. And it does so the way we think a defensive tool should: it watches first, and tells you what it sees, before it ever gets in the way.
What's in 1.1: Layer 2, input inspection
As PHP decodes each request value, Howdah scans its content for three families of attack pattern, in GET query parameters, POST fields, cookies and the URL path — the same request hook Layer 1 already uses:
- SQL injection — shapes like
' OR 1=1 --in a value that otherwise passes every size and count check. - Path traversal —
../../etc/passwdand the usual targets, including percent-encoded forms on the URL path. - Command / code injection — shapes like
; cat /etc/passwdand the common shell and PHP sink patterns.
Those are illustrative, not an exhaustive list, and they are the shapes we match — not a catalogue of exploits. Cross-site scripting is not covered in 1.1.
It logs. It does not block by default.
This is the important part, and we mean it literally. Layer 2 detects and logs; it does not block any request by default. It has its own mode, inspect.mode, which starts at detect (log only) and is independent of the global howdah.mode — so flipping howdah.mode = block, the normal Layer-1 rollout step, does not quietly turn Layer 2 into a blocker. You opt a class into blocking explicitly, once you have read your own logs and decided it is safe. Nobody installs 1.1 and finds their site started returning 403s.
A detection is one JSON log line: the rule class, the source (get, post, cookie or path) and the variable name. The matched value itself is never written to the log — so a flagged password field or token never ends up in your logs.
Why log-first, and not block-first
Because signature inspection of request content is best-effort, and it can be bypassed. That is true of every tool that does it, and pretending otherwise would be dishonest. A log is useful even when a signature is evadable: it shows you what is reaching your application so you can fix the application — parameterized queries, path normalization, no shell calls on user input. Blocking on a best-effort signature, by default, is how a WAF takes a site down on a false positive. So Howdah starts by telling you, and leaves the decision to block with you. The scanning itself is bounded and linear-time, with per-value and per-request budgets, so it can never be turned into a denial-of-service vector.
Repositories that keep every version
1.1 is our first second release, so it is also the first test of the apt and yum repositories as upgrade paths. Each publish now seeds its index from the existing published pool, so installing Howdah gives you 1.1 while 1.0 stays in the index too — you can pin or roll back to a prior version through the repo, not just the latest. Nothing is deleted, and the signatures verify against the same key.
Honest about scope
Layer 2 is best-effort signature inspection that runs log-first; it is not a guarantee, and it is not a replacement for fixing the underlying code or for patching PHP. Every claim on this site still links to the test behind it, and our tests reproduce only the harmless shape of an attack, never a working exploit. Layers 3 and 4 — runtime sink checks and post-breach containment — remain the roadmap, not part of 1.1.
Get it
If you are already on Howdah, apt-get update && apt-get upgrade (or the yum equivalent) brings in 1.1; Layer 2 arrives in detect mode, logging only. New here? Start at the install picker, read the configuration reference for the [inspect] settings, and check the coverage table for your PHP version. The source and this site are on GitHub — if Layer 2 flags something interesting on your traffic, we would like to hear about it.