New answers tagged mod-security
Rules that fire will be in the standard Apache Error log and you should see an [id: XXXX] field which is the rule id that fired (950001 in this example) and the config file where that rule was defined (/www/apache2/conf/modsecurity.d/crs/owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf in this example): [Mon May 09 ...
You could use the REQUEST_FILENAME variable instead of REQUEST_URI. You are recommended not to directly edit the OWASP CRS rules themselves but instead to add extra rules to adjust them. This allows you to upgrade the CRS and still keep your rules. Here you could do this by adding the following config after you load all the OWASP CRS rules files to adjust ...
Add the following to your Apache config after you load the /usr/share/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf file: SecRuleUpdateTargetById 981319 !ARGS:'g-recaptcha-response' Note you may need to whitelist this argument from other rules similarly.
Top 50 recent answers are included