My variable seems to never expire...
Mikaël Pirio <[email protected]>
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <CAG1WCxiDKZgLD_mhHYtmBZ7wSv+jMXA+joDt5ypta=7n6i1mwQ@mail.gmail.com> |
Hello,
I'm new in modSecurity rules and I try to define some rules in my
modsecurity config (NGinx and libmodsecurity 3.0.3 - Debian).
One of these rules is a limit rate rule: I would like to limit users to 20
req/mn on my /api.* . So I define theses :
SecRule REQUEST_COOKIES:PHPSESSID "!^$" \
"id:400010,\
phase:1,\
pass,\
nolog,\
setsid:%{REQUEST_COOKIES.PHPSESSID}"
SecRule REQUEST_URI "^/api/" \
"id:400011,\
phase:2,\
pass,\
nolog,\
setvar:'session.api_req_counter=+1',\
expirevar:'session.api_req_counter=60'"
SecRule SESSION:API_REQ_COUNTER "@gt 20" \
"id:400012,\
deny,\
status:429,\
log,\
msg:'RATELIMITED',\
chain"
SecRule REQUEST_URI "^/api/"
It works: requests are denied! but they are forever. My
variable session.api_req_counter is never reseted.
Could you help me?
Thanks,
--
Mikaël,
_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/