I am seeing strange behavior on an Apache server. When a parameter is set twice in the URL (e.g.,
https://example.com/xxx/xxx.cgi?toto=1&toto=1), I get a 403 error from Apache.
mod_security is installed on this server, and I think that’s what’s causing the problem, but I can’t find the rule to disable it.
?toto=1&toto=1 => 403
?toto=1&toto=2 => 403
?toto=1&titi=1 => OK