It looks like I can use the server variable
THE_REQUEST, as per this answer: https://stackoverflow.com/a/27968463/160565
I'm using mod_rewrite to dump
THE_REQUEST into an environment variable just above the mod_security rules, then matching on that.
THE_REQUEST is an Apache server variable used by mod_rewrite, not a mod_security variable. The directly equivalent variable in mod_security is
REQUEST_LINE, ie. the first line of the request. This takes the form of a string like:
GET /foo/bar HTTP/1.1
THE_REQUEST (mod_rewrite) variable does not change when the URL is rewritten, whereas
REQUEST_URI (mod_rewrite) does.
However, I'm a bit surprised that the
REQUEST_URI (mod_security) variable is returning the rewritten URL (maybe this is to do with the ordering of directives or using mod_security embedded?), instead of the originally requested URL, unless you are actually using the
REQUEST_URI (mod_rewrite) variable (assigning this to an env var?) in your mod_security rule?
just above the mod_security rules...
The mod_security rules should probably be at the top of your file, if not already, before any mod_rewrite directives. (Although whether the order really matters I'm not sure.)
Note that the
REQUEST_URI (mod_security) variable is not the same as the
REQUEST_URI (mod_rewrite) variable, despite being named the same. Notably,
REQUEST_URI (mod_security) contains the query string, whereas
REQUEST_URI (mod_rewrite) does not.
REQUEST_URI (mod_security) variable is returning the rewritten URL
You may be running the mod_security rule too late in the request, ie. in the wrong
phase? To process the requested URL you should be comparing against
REQUEST_URI in either phase 1 or 2 (the request). Later phases (ie. 3 - 5) will process against the response which may explain why you are seeing the rewritten URL and not the requested URL.
phase is set in the action argument or
SetDefaultAction directive. For example:
SecRule REQUEST_URI "attack" "phase:1,id:52,t:none,t:urlDecode,t:lowercase,t:normalizePath"
The five phases are:
- Request headers (REQUEST_HEADERS)
- Request body (REQUEST_BODY)
- Response headers (RESPONSE_HEADERS)
- Response body (RESPONSE_BODY)
- Logging (LOGGING)
Starting in ModSecurity version v2.7 there are aliases for some phase numbers:
2 - request
4 - response
5 - logging
SecRule REQUEST_HEADERS:User-Agent "Test" "phase:request,log,deny,id:127"