Feature/hostname logging v5

[stardothosting]

Add unique_id and improve hostname logging in WAF violation logs

Background

This PR addresses part of issue #75 where hostname information is missing or empty in WAF logs. While the core issue of empty [hostname ""] in Coraza logs remains to be solved at a deeper level, this PR improves log correlation by:

1. Adding the hostname from the request to our custom WAF violation logs
2. Including the unique_id to link these logs with the detailed Coraza logs

This allows operators to correlate WAF events across multiple domains/hostnames until the core hostname logging issue is resolved in Coraza.

Changes

• Added hostname extraction from request to WAF violation logs
• Added unique_id extraction from matched rules
• Improved log correlation between detailed Coraza logs and summary logs

Example Log Output

{
"level": "error",
"logger": "http.handlers.waf",
"msg": "WAF rule violation detected",
"hostname": "example.com",
"uri": "/?s=../../etc/passwd",
"client_ip": "10.0.0.1:12345",
"unique_id": "TJDwCHtXQPLaaQFhqry"
}

Testing Done

• Tested with path traversal attacks
• Verified unique_id correlation with detailed Coraza logs
• Confirmed hostname logging works correctly
• Verified logs can be correlated across multiple domains

Related Issues

• Missing hostname in WAF logs #75

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jcchavezs]

why is this needed?