Re: My variable seems to never expire...
Ervin Hegedüs <[email protected]>
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <[email protected]> |
Hi Mikaël, On Tue, Sep 15, 2020 at 08:29:50PM +0200, Mikaël Pirio wrote: ... > SecRule REQUEST_URI "^/api/" \ > "id:400011,\ > phase:2,\ > pass,\ > nolog,\ > setvar:'session.api_req_counter=+1',\ > expirevar:'session.api_req_counter=60'" ... > It works: requests are denied! but they are forever. My > variable session.api_req_counter is never reseted. I didn't checked the logic of the rules, but after the quick view I assume the expirevar has no effect (it's not implemented). Btw it's documented: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#expirevar "Supported on libModSecurity: TBI" a. _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/