1

I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any CRS rule work unproperly? really appreciated for the answer .

Improve this question

1 Answer 1

Reset to default
1

CRS co-lead here. First, I would recommend to use the newest release of CRS 3.2.2: https://coreruleset.org/installation/ Usually you can just delete your old coreruleset files (maybe keeping your crs-setup.conf) and unzip the new ones over your old copy.

You can definitely limit the file size that's inspected. This will protect against DoS by sending huge requests. In mod_security2.conf, you have the variables:

SecRequestBodyLimit 104857603
SecRequestBodyNoFilesLimit 104857603
SecRequestBodyLimitAction Reject

The first ones limit the requests to a little more than 100MB (Internet Explorer uses a few more bytes). This should be enough for most applications, but if your app requires bigger requests you can increase this value.

The last line will tell the firewall what to do with larger requests: do you want to block all larger requests? If you use Reject, it will keep your security high, but large requests will be rejected. This may not be acceptable for you. If you use ProcessPartial, only the first 100MB will be scanned so you still have some protection but not completely.

Improve this answer
2
  • Really appreciated the feedback, if I just disable the option "inspect the request body". what value should be in the below three lines? SecRequestBodyLimit "what value should be" SecRequestBodyNoFilesLimit "what value should be" SecRequestBodyLimitAction "what value should be"
    – 边明凯
    Commented Jan 28, 2022 at 13:02
  • Hi, I don't understand your message, could you try explaining it to me again?
    – lifeforms
    Commented Jan 31, 2022 at 16:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .