Re: 回复： Variable that holds scheme

Dear huiming, hi

Do you think that there is variable in the config or do you suggest editing
the source codes?

On Fri, Apr 15, 2022 at 6:28 AM huiming via mod-security-users <
[email protected]> wrote:

>
>
> seems scheme can be get  from ngx_http_request_s->schema
>
>
> ------------------ 原始邮件 ------------------
> *发件人:* "huiming" <[email protected]>;
> *发送时间:* 2022年4月15日(星期五) 上午9:01
> *收件人:* "mod-security-users"<[email protected]>;
> *主题:* 回复： [mod-security-users] Variable that holds scheme
>
> seems https://github.com/SpiderLabs/ModSecurity-nginx does not copy
> scheme from nginx to modsecurity.
>
> so mod can not get it.
>
>
> ------------------ 原始邮件 ------------------
> *发件人:* "mod-security-users" <[email protected]>;
> *发送时间:* 2022年4月14日(星期四) 下午4:37
> *收件人:* "mod-security-users"<[email protected]>;
> *主题:* Re: [mod-security-users] Variable that holds scheme
>
> Hi Andrew
>
> Yes, I am trying to answer the question, but not to treat them
> differently. I just need to log the scheme in the Modsecurity Audit log.
> I have tried different variables like REQUEST_URI
> <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#REQUEST_URI>,
> REQUEST_URI_RAW
> <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#REQUEST_URI_RAW> and
> etc. none of them contain the scheme!
>
>
> On Wed, Apr 13, 2022 at 3:38 PM Andrew Howe <[email protected]>
> wrote:
>
>> Hi Ehsan,
>>
>> > This question might look basic, but I could not find the variable that
>> holds or contains the (http|https) scheme.
>>
>> Where are you trying to pull the scheme from? The scheme isn't
>> typically* transmitted in an HTTP request.
>>
>> A URL will usually be broken up into an HTTP request line and a Host
>> header, which usually looks something like:
>>
>>     GET /docs/ HTTP/2
>>     Host: coreruleset.org
>>
>> No scheme/protocol.
>>
>> What are you trying to achieve? Are you trying to answer the question
>> "did this request come in as plain text HTTP or has TLS termination
>> been performed", and then treat the two cases differently?
>>
>> Thanks,
>> Andrew
>>
>>
>> *You may find request lines containing a full 'absolute URI' which
>> includes the scheme, for example with a proxy server.
>> --
>>
>> Andrew Howe
>> Loadbalancer.org Ltd.
>> www.loadbalancer.org
>> +1 888 867 9504 / +44 (0)330 380 1064
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
>
>
> --
>                         regards
>                   Ehsan Mahdavi
>          Computer Engineering Ph.D.
>
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
                        regards
                  Ehsan Mahdavi
         Computer Engineering Ph.D.

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/