Two SecDefaultAction in OWASP ModSecurity Core Ruleset

2
votes

I just downloaded the latest version (2.2.9) of the OWASP ModSecurity Core Ruleset.

In the provided "modsecurity_crs_10_setup.conf.example" there are two SecDefaultAction directive right next to each other:

SecDefaultAction "phase:1,deny,log"
SecDefaultAction "phase:2,deny,log"

I thought that as soon as a new SecDefaultAction directive is defined this one will be used for the following rules. Therefore I do not understand what the purpose of

SecDefaultAction "phase:1,deny,log"

is when another SecDefaultAction is defined immediately afterwards.

Thanks, Ronald

1
owaspmod-securitymod-security2

1 Answers

0
votes

The second action is what happens if you exceed your threshold during phase 2 in stead of in phase one.

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#processing-phases