I have ModSecurity v2 on apache with CRS v3.

Requests containing header accept-charset are blocked on paranoia level 1, I read this great discussion about the header and that on CRS v4 will be allowed by default.

How can I write an exclusion rule to allow accept-charset header?

1 Answer 1


OWASP ModSecurity Core Rule Set Dev on Duty reporting. If you're working with a CRS v3 installation then you can configure CRS to allow the Accept-Charset header by removing it from the 'tx.restricted_headers' list in your crs-setup.conf file.

For CRS v4 we moved Accept-Charset to a new variable/list called 'tx.restricted_headers_extended'. This new list of headers is blocked at paranoia level 2, so if you use CRS v4 at PL2 or above then you would need to configure this list instead.

  • Could you perhaps tell us how to remove the header from 'tx.restricted_headers'? What specifically do we need to put in crs-setup.conf?
    – richard
    Commented Feb 29 at 2:26
  • 1
    @richard As above, it depends on whether you're using CRS v3 or v4. Assuming you're using v3, you would open your crs-setup.conf and find the section on 'restricted_headers'. Where the file says "Uncomment this rule to change the default", if you don't like the default setting then change it to whatever suits your deployment, and uncomment the rule. Now your custom setting will replace the default one. Be sure to reload or restart whatever services or containers are appropriate for your deployment, and you're good to go.
    – xanadu
    Commented Mar 15 at 22:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .