RESPONSE_STATUS not effect well

[meigea]

Describe the bug

I have set my rule like this but not run . and it stayed in ppending not returned the error403page.

it always pending and not returend , how can i solve it to make the response_status like 5xx all returned 403page.

SecRule RESPONSE_STATUS "@pmf /var/local/share/patch_rules/patch_rule_datas/StatusFilter.data" 
      "noauditlog,\
      redirect:/403_forbidden.html,\
      id:56783000,\
      phase:3"

A clear and concise description of what the bug is.

Logs and dumps

Output of:

1. DebugLogs (level 9)
2. AuditLogs
3. Error logs
4. If there is a crash, the core dump file.

modsec_audit.log
debug.log

[meigea]

i have tried it in phaser:4/5 and also that.

[155618319935.179936] [/test523] [4] (Rule: 56783000) Executing operator "PmFromFile" with param "/var/local/share/patch_rules/patch_rule_datas/StatusFilter.data" against RESPONSE_STATUS.
[155618319935.179936] [/test523] [9] Target value: "523" (Variable: RESPONSE_STATUS)
[155618319935.179936] [/test523] [9] Matched vars updated.
[155618319935.179936] [/test523] [4] Rule returned 1.
[155618319935.179936] [/test523] [9] Running action: status
[155618319935.179936] [/test523] [9] Running action: noauditlog
[155618319935.179936] [/test523] [4] Running (disruptive)     action: redirert.
[155618319935.179936] [/test523] [8] Skipping this phase as this request was already intercepted.
[155618319935.179936] [/test523] [4] Not appending response body. Response Content-Type is . It is not marked to be inspected.

can i set some ctl:skip to solve it ? if can , how can i solve.

[victorhora]

Hi @meigea

I believe your problem is probably on this line from your debug logs:

 [155618319935.179936] [/test523] [4] Not appending response body. Response Content-Type is . It is not marked to be inspected.

For some reason the Content-Type header of your response is empty.

Make sure your webserver is returning a valid Content-Type that matches your SecResponseBodyMimeType configuration (see modsecurity.conf-recommended#L155 for reference).

Also, when reporting issues or asking questions, please make sure that you provide all information described on the issue template including the detailed version of ModSecurity, webserver, ruleset etc. Otherwise it's much harder or impossible for the community to help you.

Thanks.

[meigea]

@victorhora thank you very much . i really worked.