I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page.

For example, one problem is that images are not displayed because they're raising a mod_security patterns. So my question is, Can I somehow disable mod_security patterns for file names?

  • 3
    What rules are being matched? Can you share the logs? What rules have you activated in your httpd.conf? – Mark Hillick Jul 25 '12 at 14:42

As Mark Hillick said, we'd have to see the mod_security audit logs to answer this. The logs will show just which OWASP rules are being matched. You could then read the documentation for the rule(s) here. Or you could post a couple of examples of the logs here, showing the specific matches. Then we could better help sort this out with you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.