Web Application Defender's Cookbook

Recipe 1-8: Ignoring Requests for Static Content

This recipe shows you how to configure ModSecurity to exclude audit logging of HTTP requests for static resources.

Ingredients

• ModSecurity Reference Manual17
  • ctl:ruleEngine action
  • ctl:auditEngine action

Logging all HTTP transactions is ideal from an incident response perspective. However, some organizations may decide that they want to exclude inspection and logging of requests for static resources to improve performance and latency and reduce the amount of logging required. The theory is that if a request for some type of static resource (such as image files) occurs, the potential attack surface is greatly reduced, because there are no parameters. Parameter payloads are used as the primary injection points for passing attack data to dynamic resources that accept user input for internal processing. If we want to disable inspection and logging for these static resource requests, we must first analyze the request components to ensure that they are not attempting to pass any parameter data. Take a look at the following sample rules:

SecRule REQUEST_METHOD "@pm GET HEAD" "id:'999001',chain,phase:1,
t:none,nolog,pass"
        SecRule REQUEST_URI "!@contains ?" "chain"
                SecRule &ARGS "@eq 0" "chain"
                        SecRule &REQUEST_HEADERS:Content-Length|
&REQUEST_HEADERS:Content-Type "@eq 0" "ctl:ruleEngine=Off,
ctl:auditEngine=Off"

This chained rule set verifies the request details by doing the following:

• It verifies that the request method is either ...