Web Application Defender's Cookbook

Recipe 6-3: Response Body Access

This recipe shows you how to configure ModSecurity to gain access to response body content.

Ingredients

• ModSecurity
  • SecResponseBodyAccess directive
  • SecResponseBodyMimeType directive
  • SecResponseBodyLimit directive
  • SecResponseBodyLimitAction directive

Basic Directives

By default, ModSecurity does not access, process, or analyze response body content. This poses serious issues with false negatives, because you would have no visibility into what type of data is leaving your web application. To gain insight into response bodies, you must configure a few ModSecurity directives. Here is a sample listing:

# -- Response body handling ---------------------------------------- # Allow ModSecurity to access response bodies. # You should have this directive enabled in order to identify errors # and data leakage issues. # # Do keep in mind that enabling this directive does increase both # memory consumption and response latency. # SecResponseBodyAccess On # Which response MIME types do you want to inspect? You should # adjust the configuration below to catch documents but avoid static # files (e.g., images and archives). # SecResponseBodyMimeType (null) text/plain text/html text/xml # Buffer response bodies of up to 512 KB in length. SecResponseBodyLimit 524288 # What happens when we encounter a response body larger than the # configured limit? By default, we process what we have and let the # rest through. That's somewhat less secure, but does not break ...