Question: how is setenv supposed to work in ModSecurity 3.0.x

Open
#3,449 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
nginx
Domain
backend

Research direction

Start with the setenv documentation and the reported Nginx configuration using $CUSTOMFORMACTION in proxy_set_header. Compare the ModSecurity and Nginx debug-log observations to determine whether the variable is exposed to Nginx. Done means establishing the supported behavior and documenting or correcting the integration guidance.

Written by the indexing model from the issue text.

Description

Hi,

In the documentation under setenv there is a sentence Description: Creates and updates environment variables that can be accessed by both ModSecurity and the web server.

I have rule that detects specific forms actions from GET and POST requests (parameter called "formaction"). I expanded the rule by registering a setenv variable called CUSTOMFORMACTION. This part all works - rule triggers, writes to log and all that. Now comes the issue.

How am I supposed to access this new env variable in Nginx? When I just try to access it by $CUSTOMFORMACTION or $customformaction I get an nginx error on startup: nginx: [emerg] unknown 'customformaction' variable. Is there a special way of accessing the variable?

My ultimate goal is to create a configuration entry like this: proxy_set_header x-custom-form-action $CUSTOMFORMACTION.

or is there an way to add a header from a modsecurity rule in nginx like there is supposed to be in apache (using mod_headers)

Edit: From debug log I can see that ModSecurity is creating the setenv variable with the correct value (well it is till encapsulated between / / - but I think this would not stop it from working at this point), but in nginx debug log I see no mention of that variable other than in generic phase 6 there is a reference to the ModSecurity rule match. Nothing like http script var event or similar

Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from owasp-modsecurity/ModSecurity

All issues in owasp-modsecurity/ModSecurity

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.