Re: Syntax error for rule by trustwave
Ervin Hegedüs <[email protected]>
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <[email protected]> |
Hi Homesh,
On Tue, Oct 01, 2019 at 07:29:53PM +0530, homesh joshi wrote:
>
> here is is the final thing that worked for me. Now I am testing the rule
> for various conditions.
good to see,
> #Step1
> ## This rule will identify the outbound Set-Cookie SessionID data and capture it in a setsid#
> SecRule RESPONSE_HEADERS:/Set-Cookie2?/ > "(?i:(j?sessionid|(php)?sessid|(asp|jserv|jw)?session[-_]?(id)?|cf(id|token)|sid).*?=([^\s].*?)\;\s?)" "chain,phase:3,id:'881062',t:none,pass,nolog,capture,setsid:%{TX.6},setvar:session.sessionid=%{TX.6},setvar:tx.ip=%{remote_addr},setvar:tx.ua=%{request_headers.user-agent}"
just my 2 cents: you would better to use the actions that you
quote its arguments, eg:
setvar:'tx.ua=%{request_headers.user-agent}'
It's not mandatory, but more clear.
a.
_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/