-
Notifications
You must be signed in to change notification settings - Fork 1.7k
How to properly handle custom status after phase 3, 4 interception #3357
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
Hi @meguoe, what rules you see in error.log or audit.log, in section |
This log file is generated when the default action for phase 3, 4 is not set. |
This log file was generated after setting the default values for stages 3 and 4. But in fact, the client browser displayed a 502 error. There is an alert in the nginx error.log
|
This is the result printed by curl, which has some differences from the browser. The audit log shows http_code: 419, while curl displays HTTP/1.1 200 OK. 20250408-090049-103-http-d5b286a078b3f090fa04cb18e32d3fcf.log
|
Uh oh!
There was an error while loading. Please reload this page.
ModSecurity version (and connector): ModSecurity v3.0.13 with nginx-connector v1.0.3
WebServer: nginx-1.27.2
OS (and distro): alpine:3.20.3
Description
I am trying to implement custom HTTP status codes for deny actions across all phases.
When setting the default action for phase 1 and 2 using the following configuration:
ModSecurity correctly intercepts the request and responds with HTTP 419 as expected.
However, when I do not define default actions for phase 3 and 4, triggering rules in these phases only results in audit logs being generated, and the request is not blocked — the response is HTTP 200.
When I then add default actions for phase 3 and 4:
I see the audit log reporting http_code: 419, but the actual response received by the client is HTTP 502.
My Goal
I want to enforce a custom status code (e.g., 419) for phase 3 and 4 deny actions, just like in phase 1 and 2.
Questions
I want to enforce custom status codes (such as 419) in the reject operations of stages 3 and 4, just like in stages 1 and 2. How specifically do I need to modify the configuration?
Test Rule
The text was updated successfully, but these errors were encountered: