NAXSI is a Web Application Firewall (WAF). Naxsi doesn't rely on a signature base like an antivirus, and thus cannot be circumvented by an "unknown" attack pattern. Here are some notes on how to compile, install and configure NAXSI:

Download

The latest version of NAXSI can be found at: https://github.com/wargio/naxsi

Identify your version of NGINX:

Use this to download the matching NGINX source code:

We must compile nginx with the same arguments as you had previously configured Nginx with, to do that use -V attribute to get the list.

Compile

Configure the make files using the above arguments:

Install

Modify /etc/nginx.conf

At the top of the file, add:

Inside the http bracket (config), include the 'naxsi_core.rules' that comes with NAXSI.

Also create your own custom whitelist set of rules. (More on this below.)

In your server config, include some naxsi.rules:

The naxsi.rules should look like this:

Enable LearningMode to discover which rules you would like to add to your 'naxsi_whitelist.rules'.

LearningMode will log the errors, but enforce the rule. By testing the website, you can eventually 'learn' which rules need to be whitelisted.

Look in the NGINX error_log: /var/log/nginx/error.log

Here's an example of naxsi_whitelist.rules: https://github.com/nbs-system/naxsi/wiki/whitelists-examples

Errors

Missing Libraries

Here are some solutions to common errors I encounter:

Disable Warnings as Errors

Place the CFLAGS option in front of the configure command:

Undefined Symbol 'libinjection_xss'

This one drove me up the wall.

Do not install the system packages 'libinjection' and 'libinjection-devel'.

NAXSI comes with libinjection as a git submodule. It will use that instead when compiling.

---

AI has these comments about installing NAXSI on ARM:

Good news: no fork needed. NAXSI builds and works on ARM, first try, with essentially your existing recipe.

What I did: since this Mac had no container tooling, I installed colima + the docker CLI (Homebrew), started a native arm64 Linux VM, and repro'd your wiki notes verbatim in an oraclelinux:9 aarch64 container — dnf nginx (1.20.1, same version as your notes), matching nginx source, git clone --recurse-submodules wargio/naxsi, CFLAGS="-Wno-error" ./configure --add-dynamic-module=... $(nginx -V args). The module compiled with zero errors or ARM-specific warnings, and a live nginx with your naxsi.rules (SecRulesEnabled, the five CheckRules) detected and blocked both a SQL injection ($SQL score 12) and an XSS probe ($XSS score 8) while serving clean requests normally. This matches the ecosystem evidence — Arch Linux ARM and GetPageSpeed both ship aarch64 naxsi packages.

Deltas from your x64 notes, worth adding to the wiki:

- libnsl2-devel doesn't exist in OL9's default repos (it moved to CodeReady Builder). It's also unnecessary for a module-only build. If this was the wall you hit on ARM, that would explain it — it's a repo-layout difference, not an architecture problem.
- redhat-rpm-config is required — the distro's configure args reference -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1, which that package provides.
- make modules is all you need — builds just the .so files, no full nginx build or make install.

One behavioral gotcha I confirmed while verifying: with DeniedUrl "/404.html", blocked requests return the stock 404 page with HTTP 200 — the block is real (the attack body is byte-identical to 404.html, and NAXSI_FMT lines land in error.log), but the status code doesn't say so. For the demo env I'd use a dedicated location /RequestDenied { return 403; } so blocks are visible in access logs and to monitoring.

Two caveats before we call it done: I built naxsi master — for the real deployment we should pin a release tag; and this was OL9. The naxsi-ol9 container is still running with the full build if you want to poke at it. To do this for real: what's the OCI Ashburn instance running (OL8 vs OL9), and do you want to hand me SSH access to build it there — or if you remember what your earlier ARM attempt actually died on, I can check whether master already fixed it.