1

Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules...

On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them differently from the example config file?

Example:

SecAction \
 "id:900250,\
  phase:1,\
  nolog,\
  pass,\
  t:none,\
  setvar:'tx.restricted_headers=/proxy/ /lock-token/ /content-range/ /translate/ /if/'"

SecAction \
 "id:900200,\
  phase:1,\
  nolog,\
  pass,\
  t:none,\
  setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"

By default SecAction id:900200 is written before SecAction id:900250, is that order important?

2
  • Apparently the rules can be in any order on the crs-setup.conf...
    – intika
    May 21, 2020 at 4:25
  • Yes, the order is important. Rules will evaluated where they are defined (grouped by the phases). In the example above the rule 900250 will evaluated before 900200 (before they are in phase:1).
    – airween
    Nov 3, 2020 at 17:17

1 Answer 1

0

The number is not important. Import the include order of the rules in your web service and the phase that is executed, this will determine the order in which the rules will be executed.

In the case of "SecAction" it should always be "phase:1" and if for example you have a rules file with only SecActions in your web service or in VirtualHost (Apache, I don't know how it is in nginx) of your hosting it should be included before other rule sets like CRS for example

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .