About SecRequestBodyAccess Off and SecResponseBodyAccess Off

[f2ex]

If SecRequestBodyAccess Off and SecResponseBodyAccess Off are set ，then the other defensive rules will have a defensive effect ? thank u

[victorhora]

It would depend on the remaining defensive rules that are enabled. If the other rules are for example looking for matches on Phase Request Headers (query string, cookies and other headers) it will work fine.

If you look at the description for SecRequestBodyAccess on the reference manual you will see the following:

"This directive is required if you want to inspect the data transported request bodies (e.g., POST parameters). Request buffering is also required in order to make reliable blocking possible."

Meaning that variables like ARGS_POST, REQUEST_BODY and STREAM_INPUT_BODY will be empty and you wont be able to match on them. See also Phase Request Body.

The same concept applies to SecResponseBodyAccess.

[defanator]

@victorhora @zimmerle seems like this one is still working incorrectly with libmodsecurity: ARGS_POST and ARGS_POST_NAMES are still being evaluated when SecRequestBodyAccess set to off.

[victorhora]

#1886 should fix this. Please confirm if it works for you ;)