[HELP] Nextcloud Calendar won't load fully: OPTIONS /remote.php/dav/principals/users/myuser/ gets 400 not reported by UI

What happened?

Browse to Nextcloud Calendar, but it doesn't load calendars nor events. Should load everything as expected. OPTIONS /remote.php/dav/principals/users/myuser/ gets 400 not reported by UI, even though OPTIONS is allowed.

Calendar loads fine with USE_MODSECURITY disabled.

How to reproduce?

Browse to Nextcloud Calendar. nextcloud-aio-nextcloud version: 33.0.5.1 calendar: 6.5.0. USE_MODSECURITY enabled

Configuration file(s) (yaml or .env)

IS_DRAFT=no
SERVER_NAME=example.com
USE_TEMPLATE=low
BAD_BEHAVIOR_THRESHOLD=30
BAD_BEHAVIOR_BAN_TIME=3600
CORS_ALLOW_ORIGIN=*
USE_CROWDSEC=yes
KEEP_UPSTREAM_HEADERS=*
CONTENT_SECURITY_POLICY=
REFERRER_POLICY=no-referrer-when-downgrade
PERMISSIONS_POLICY=
COOKIE_FLAGS=
AUTO_LETS_ENCRYPT=yes
EMAIL_LETS_ENCRYPT=e-mail@example.com
LETS_ENCRYPT_CHALLENGE=dns
LETS_ENCRYPT_DNS_PROVIDER=cloudflare
USE_LETS_ENCRYPT_WILDCARD=yes
LETS_ENCRYPT_PROFILE=shortlived
LETS_ENCRYPT_DNS_CREDENTIAL_ITEM=cloudflare_api_token snip
LIMIT_CONN_MAX_HTTP1=25
LIMIT_CONN_MAX_HTTP2=200
LIMIT_CONN_MAX_HTTP3=200
LIMIT_REQ_RATE=15r/s
ALLOWED_METHODS=GET|POST|HEAD|OPTIONS|PUT|DELETE|PATCH|PROPFIND|PROPPATCH|REPORT|MKCOL|COPY|MOVE|LOCK|UNLOCK
MAX_CLIENT_SIZE=1g
USE_REAL_IP=yes
REAL_IP_HEADER=CF-Connecting-IP
REAL_IP_FROM_URLS=https://www.cloudflare.com/ips-v4/ https://www.cloudflare.com/ips-v6/
USE_REVERSE_PROXY=yes
REVERSE_PROXY_SSL_SNI=yes
REVERSE_PROXY_HOST=http://sub.example.com:11000
REVERSE_PROXY_WS=yes
USE_ROBOTSTXT=yes
ROBOTSTXT_COMMUNITY_LISTS=ai-robots-txt robots-disallowed

Relevant log output

ModSecurity: Access denied with code 400 (phase 2). Matched "Operator `Eq' with parameter `0' against variable `REQBODY_ERROR' (Value: `1' ) [file "/etc/nginx/example.com/server-http/modsecurity-rules-global-crs.conf.modsec"] [line "14"] [id "200002"] [rev ""] [msg "Failed to parse request body."] [data "XML parsing error: XML: Failed to parse document."] [severity "2"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "example.com"] [uri "/remote.php/dav/principals/users/myuser/"] [unique_id "snip"] [ref "v1360,1"]

BunkerWeb version

1.6.11

What integration are you using?

Docker

Linux distribution (if applicable)

No response

Removed private data

• I have removed all private data from the configuration file and the logs

Code of Conduct

• I agree to follow this project's Code of Conduct