15 lines
711 B
Plaintext
15 lines
711 B
Plaintext
# Local hardening rules for reverse proxy front door.
|
|
# IDs in local/private range to avoid OWASP CRS collisions.
|
|
|
|
# Restrict uncommon HTTP methods.
|
|
SecRule REQUEST_METHOD "!@within GET HEAD POST PUT PATCH DELETE OPTIONS" \
|
|
"id:1000100,phase:1,deny,status:405,log,msg:'Method not allowed by edge policy'"
|
|
|
|
# Block requests that try to smuggle malformed content length headers.
|
|
SecRule &REQUEST_HEADERS:Content-Length "@gt 1" \
|
|
"id:1000101,phase:1,deny,status:400,log,msg:'Multiple Content-Length headers detected'"
|
|
|
|
# Basic path traversal hardening before app routing.
|
|
SecRule REQUEST_URI "@rx (?:\.\./|%2e%2e%2f|%2e%2e/)" \
|
|
"id:1000102,phase:1,deny,status:403,log,msg:'Traversal payload in request URI'"
|