2

What is the most efficient way to limit the length of a http request parameter using Mod Security? For example, to limit WordPress comment length :

SecRule ARGS:comment "^.{65530}"

Would this regex expansion slow mod-security down significantly?

Or would this be the fastest?

SecRule ARGS:comment "@gt 65530" "t:none,t:length"
Improve this question
1
  • Surely it has to be faster using gt -> If nothing else than because the OWASP CRS team uses gt for a similar length check in at least one of their rules - and I'd expect them to be most knowledgable at performance tuning this sort of thing....
    – Paul H
    Mar 28, 2022 at 15:34

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .