Request is interrupted but audit log shows no

[skyflyer]

I am having trouble identifying a rule that interrupts the response from the server. It is a GET request, the server returns HTTP 200, but caddy + coraza returns 403.

I enabled audit and debug logging, but the audit log does not contain rules that match, just that the request was interrupted.

As in #206, debug log is not written.

What am I missing? How can I see which rule blocks the response?

Config is pretty basic (with some directives removed, but that's the gist of it):

some.server.tld {
	@waf_enabled not path /foobar/*
	header -Via
	coraza_waf @waf_enabled {
		load_owasp_crs
		directives `
Include @coraza.conf-recommended
Include @crs-setup.conf.example
Include @owasp_crs/*.conf
SecRuleEngine On
`
	reverse_proxy 172.28.0.2:8000 {
		header_up X-Forwarded-Port 443
	}
}

A complete entry from audit log

{
    "transaction": {
        "timestamp": "2026/06/07 19:27:58",
        "unix_timestamp": 1780860478114995733,
        "id": "QvGZciNEnqVToflA",
        "client_ip": "redacted",
        "client_port": 0,
        "host_ip": "",
        "host_port": 0,
        "server_id": "redacted",
        "request": {
            "method": "GET",
            "protocol": "HTTP/3.0",
            "uri": "/en/invalid_user/",
            "http_version": "",
            "headers": {
                "accept": [
                    "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8"
                ],
                "accept-encoding": ["gzip, deflate, br, zstd"],
                "accept-language": ["en-US,en;q=0.6"],
                "authorization": [
                    "Basic redacted"
                ],
                "cache-control": ["no-cache"],
                "cookie": [
                    "sessionid=redacted; csrftoken=redacted"
                ],
                "host": ["uav-test.caa.si"],
                "pragma": ["no-cache"],
                "priority": ["u=0, i"],
                "sec-ch-ua": [
                    "\"Brave\";v=\"149\", \"Chromium\";v=\"149\", \"Not)A;Brand\";v=\"24\""
                ],
                "sec-ch-ua-mobile": ["?0"],
                "sec-ch-ua-platform": ["\"macOS\""],
                "sec-fetch-dest": ["document"],
                "sec-fetch-mode": ["navigate"],
                "sec-fetch-site": ["none"],
                "sec-fetch-user": ["?1"],
                "sec-gpc": ["1"],
                "upgrade-insecure-requests": ["1"],
                "user-agent": [
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
                ]
            },
            "body": "",
            "files": null,
            "args": {},
            "length": 0
        },
        "response": {
            "protocol": "",
            "status": 200,
            "headers": {
                "content-language": ["en"],
                "content-length": ["22063"],
                "content-security-policy": [
                    "default-src 'none'; script-src 'self' https://player.vimeo.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self'; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://player.vimeo.com; form-action 'self'; frame-src 'self' youtube.com www.youtube.com player.vimeo.com vimeo.com; child-src 'self';"
                ],
                "content-type": ["text/html; charset=utf-8"],
                "cross-origin-opener-policy": ["same-origin"],
                "date": ["Sun, 07 Jun 2026 19:27:59 GMT"],
                "permission-policy": [
                    "geolocation=(), camera=(), microphone=(), midi=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=(), autoplay=(), display-capture=(), picture-in-picture=(), screen-wake-lock=(), clipboard-read=(), clipboard-write=(self), fullscreen=(*)"
                ],
                "referrer-policy": ["strict-origin-when-cross-origin"],
                "set-cookie": [
                    "csrftoken=redacted; expires=Sun, 06 Jun 2027 19:27:59 GMT; Max-Age=31449600; Path=/; SameSite=Lax; Secure",
                    "sessionid=redacted; expires=Sun, 07 Jun 2026 21:27:59 GMT; HttpOnly; Max-Age=7200; Path=/; SameSite=Lax; Secure"
                ],
                "strict-transport-security": [
                    "max-age=31536000; includeSubDomains; preload"
                ],
                "vary": ["Cookie"],
                "x-content-type-options": ["nosniff"],
                "x-frame-options": ["DENY"]
            },
            "body": "redacted"
        },
        "producer": {
            "connector": "",
            "version": "",
            "server": "",
            "rule_engine": "On",
            "stopwatch": "1780860478114995733 933956561; combined=37877372, p1=2415384, p2=4216725, p3=114932, p4=31070958, p5=59373",
            "rulesets": ["OWASP_CRS/4.25.0"]
        },
        "highest_severity": "",
        "is_interrupted": true
    }
}