Description
Using ModSec v3.0.1 with CRS v3.0.2, I define tx.allowed_request_content_type as follows:
SecAction
"id:900220,
phase:1,
nolog,
pass,
t:none,
setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/soap+xml|application/x-amf|application/json|application/octet-stream|text/plain'"
When I send a text/plain request, it is rejected.
I modified my assignment to re-order so that text/plain is no longer last and application/json is last.
SecAction
"id:900220,
phase:1,
nolog,
pass,
t:none,
setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/soap+xml|application/x-amf|application/octet-stream|text/plain|text/plain|application/json'"
Now, text/plain requests are accepted, but application/json requests are rejected.
Seems like the last value is not properly parsed.