Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to create a mod_security collection that is based on something other than the user's IP, Session ID, or username. Specifically, based on the REQUEST_URI. However, mod_security indicates that this is not possible. My question is whether there might be some workaround.

I tried the following, but couldn't get it to work:

SetEnvIf Request_URI "^\/([a-z0-9]+)\/" account="$1"
SecAction setsid:%{account},pass,nolog
SecAction "phase:2,pass,setvar:session.count=+1,nolog"
SecRule SESSION:COUNT "@gt 60" "phase:2,deny,status:503,skip:1,nolog"
SecAction "phase:5,deprecatevar:session.count=1/1,pass,nolog"

The above should extract the account name from the URL (line 1), and use that as the session id (line 2; this is what doesn't work). It then increases the request count on each request that includes that account name (line 3). If the count goes over 60 (line 4), a 503 error is returned. The count is decreased by 1 every 1 seconds (line 5).

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.