Topic: ModSecurity2 - HTTP_Referer

[erict]

Hi. I need to block access to a suggest links page where the referer is blank or is not from my domain. This worked in ModSecurity 1 and Apache 2.0.55:

SecFilterSignatureAction "deny,log,msg:'Suggest link spam/scraping',status:403"
SecFilterSelective HTTP_REFERER "!.*my\.domain\.org.*" chain
SecFilterSelective REQUEST_URI ".*/zzz/suggest_link.php.*"

But this doesn't in ModSecurity 2.1.0 with Apache 2.2.4:

SecDefaultAction "log,deny,status:403,phase:2,t:lowercase"
SecRule HTTP_Referer "!.*my\.domain\.org.*" "chain,msg:'Suggest link spam/scraping'"
SecRule REQUEST_URI ".*/zzz/suggest_link\.php.*"

This bit works on its own:
SecRule REQUEST_URI ".*/zzz/suggest_link\.php.*"

But this doesn't work:
SecRule HTTP_Referer "!.*sarmouni\.dyndns\.org.*"
nor using HTTP_HEADERS:Referer

Nor does this:
SecRule HTTP_Referer "^$"

Any ideas most welcome,
EricT.

[erict]

Taking the ! rule negation in the HTTP_Referer line works (though it's not what I need).

EricT.

[erict]

The negated rule works ok if the wrong referer is present, but not if there is no referer.

Ah ... v2 doesn't detect a missing header in the same way as v1.

http://www.modsecurity.org/blog/archives/2007/03/2x1x_rule_diffe.html

Hope this helps.
EricT.[/url]