Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
MIME-Version: 1.0
From: Andrei <lagged@gmail.com>
Date: Mon, 27 Feb 2017 08:49:50 -0600
Message-ID: <CAP+vvEu=h4zA-m4MMXtA7UNX7pgp0s7dSCnWikmd+KfDUF1CZA@mail.gmail.com>
To: users@httpd.apache.org
Content-Type: multipart/alternative; boundary=001a114e407e0adfce0549843118
Subject: [users@httpd] ModSecurity and custom headers
archived-at: Mon, 27 Feb 2017 14:50:00 -0000

--001a114e407e0adfce0549843118
Content-Type: text/plain; charset=UTF-8

Hi all,

How can I add a custom header using the 'msg' value from a ModSecurity
rule, for all rules triggered? I'm basically trying to track the ModSec
block reason at an edge point (Varnish) based on Apache's response.

For example, I would like:

SecRule REQUEST_URI "/modsectest"
"log,deny,status:406,phase:1,t:none,id:9084310,msg:'ModSec Log Test'"

To add a 'X-ModSec-Block' response header with the value 'ModSec Log Test'
in this case. I understand this might be better suited with setenv +
mod_headers due to blocks being done at different phases, and found
http://serverfault.com/questions/796088/modsecurity-creating-a-new-request-header-from-secrule
which seems similar to this scenario, just that it's not quite working out
for me. Any help is greatly appreciated!

Andrei

--001a114e407e0adfce0549843118
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi all,<div><br></div><div><div>How can I add a custom hea=
der using the &#39;msg&#39; value from a ModSecurity rule, for all rules tr=
iggered? I&#39;m basically trying to track the ModSec block reason at an ed=
ge point (Varnish) based on Apache&#39;s response.</div><div><br></div><div=
>For example, I would like:</div><div><br></div><div>SecRule REQUEST_URI &q=
uot;/modsectest&quot; &quot;log,deny,status:406,phase:1,t:none,id:9084310,m=
sg:&#39;ModSec Log Test&#39;&quot;</div><div><br></div><div>To add a &#39;X=
-ModSec-Block&#39; response header with the value &#39;ModSec Log Test&#39;=
 in this case. I understand this might be better suited with setenv + mod_h=
eaders due to blocks being done at different phases, and found <a href=3D"h=
ttp://serverfault.com/questions/796088/modsecurity-creating-a-new-request-h=
eader-from-secrule">http://serverfault.com/questions/796088/modsecurity-cre=
ating-a-new-request-header-from-secrule</a> which seems similar to this sce=
nario, just that it&#39;s not quite working out for me. Any help is greatly=
 appreciated!</div><div><br></div></div><div>Andrei</div></div>

--001a114e407e0adfce0549843118--