File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -419,21 +419,33 @@ cookie exclusions should be moved to separate post-CRS files using
419419SecRuleUpdateTargetById directives.
420420
421421Example of a failing rule (old pattern - not allowed):
422- SecRule !REQUEST_COOKIES: session_id |ARGS: foo "@rx attack" \
423- "id:942100,\
424- phase:2,\
425- block" # Fails: uses !REQUEST_COOKIES
422+
423+ ``` apache
424+ SecRule !REQUEST_COOKIES:session_id|ARGS:foo "@rx attack" \
425+ "id:942100,\
426+ phase:2,\
427+ block" # Fails: uses !REQUEST_COOKIES
428+ ```
429+
426430
427431Example of the correct approach (new pattern):
428432
429433In the main rule file:
430- SecRule REQUEST_COOKIES|ARGS: foo "@rx attack" \
431- "id:942100,\
432- phase:2,\
433- block"
434+
435+ ``` apache
436+ SecRule REQUEST_COOKIES|ARGS:foo "@rx attack" \
437+ "id:942100,\
438+ phase:2,\
439+ block"
440+ ```
441+
434442
435443In a separate post-CRS configuration file:
436- SecRuleUpdateTargetById 942100 "!REQUEST_COOKIES: session_id "
444+
445+ ``` apache
446+ SecRuleUpdateTargetById 942100 "!REQUEST_COOKIES:session_id"
447+ ```
448+
437449
438450See: https://github.com/coreruleset/coreruleset/pull/4378
439451
You can’t perform that action at this time.
0 commit comments