0

Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules...

On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them differently from the example config file?

Example:

SecAction \
 "id:900250,\
  phase:1,\
  nolog,\
  pass,\
  t:none,\
  setvar:'tx.restricted_headers=/proxy/ /lock-token/ /content-range/ /translate/ /if/'"

SecAction \
 "id:900200,\
  phase:1,\
  nolog,\
  pass,\
  t:none,\
  setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"

By default SecAction id:900200 is written before SecAction id:900250, is that order important?

2
  • Apparently the rules can be in any order on the crs-setup.conf... – intika May 21 '20 at 4:25
  • Yes, the order is important. Rules will evaluated where they are defined (grouped by the phases). In the example above the rule 900250 will evaluated before 900200 (before they are in phase:1). – airween Nov 3 '20 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.