Issues while using error_page and location

[zimmerle]

According to the original report (Ehsan Mahdavi) the audit logs are not working for custom error pages (using: error_page or location). In that scenario the logs are not written.

Ehsan Mahdavi also said that in case of SecRuleEngine is set to DetectionOnly everything works like expected.

[intelbg]

Hello, is there a plan to be fixed? The issue still exists and it's very serious. Also, audit_logging now works without the custom 403 page only in serial mode, not in concurrent. Thank you in advance. I think fixing this will solve many other issues and will help many people like me.

[intelbg]

In addition, the problem with concurrent logging was my mistake. It works. Remains the problem with custom 403 page only.

[intelbg]

If you don't plan to fix it can you please tell me which file and function is related to this problem ?

[victorhora]

@averges @intelbg

Have you tried enabling the intercept_errors directives (e.g. proxy_intercept_errors) directive in Nginx?

[intelbg]

hi @victorhora! Thanks about the reply. I tried - in server block and in location. but didn't help. Logging didn't work with it too with custom 403 page.

[averges]

@victorhora, yes, I've tried with intercept_errors directives but no luck.

Thank you for looking into this error.

[cauealvesbraz]

@zimmerle Here too

It's enabled the proxy_intercept_errors and returns the same problem.

[cauealvesbraz]

Maybe, have some problem in this code: https://github.com/SpiderLabs/ModSecurity-nginx/blob/master/src/ngx_http_modsecurity_module.c#L164-L186

I'm trying to understand it

[intelbg]

@ceasbz I think that the problem is in this chunk of code too, but I a can't understand and fix it. If you do it please share the fix. I will appreciate it!

[zimmerle]

Hi,

Notice the configurations [1] and [2]. They are different by the error_block location.

In [1] the error was specified inside the location block. In that case the ModSecurity rules specified for the location block will be also applied to the error. That is different from [2] where we have no ModSecurity rules configured for the error block.

In my tests, having the configuration in the right place, I managed to have ModSecurity working as expected. I am closing the bug assuming that it was a configuration issue. If you think otherwise, please re-open.

[rm3nchaca]

Hi!
I've tested the 2 example configs, the 1 is not showing the custom error page but is logging as expected, the 2 displays the custom error page but is not logging.