Files
training-software/nginx/modsecurity/custom-rules.conf
Paperclip CTO 679732de7d
All checks were successful
CI / lint (push) Successful in 7s
CI / test (push) Successful in 21s
CI / build-container (push) Successful in 6s
feat(security): add modsecurity paranoia level 4 ruleset for nginx
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-05-19 10:27:48 +02:00

15 lines
711 B
Plaintext

# Local hardening rules for reverse proxy front door.
# IDs in local/private range to avoid OWASP CRS collisions.
# Restrict uncommon HTTP methods.
SecRule REQUEST_METHOD "!@within GET HEAD POST PUT PATCH DELETE OPTIONS" \
"id:1000100,phase:1,deny,status:405,log,msg:'Method not allowed by edge policy'"
# Block requests that try to smuggle malformed content length headers.
SecRule &REQUEST_HEADERS:Content-Length "@gt 1" \
"id:1000101,phase:1,deny,status:400,log,msg:'Multiple Content-Length headers detected'"
# Basic path traversal hardening before app routing.
SecRule REQUEST_URI "@rx (?:\.\./|%2e%2e%2f|%2e%2e/)" \
"id:1000102,phase:1,deny,status:403,log,msg:'Traversal payload in request URI'"