In your crs-setup.conf file, you'll find two lines commented out: # SecDefaultAction "phase:1,log,auditlog,deny,status:403" # SecDefaultAction "phase:2,log,auditlog,deny,status:403"
Uncomment them and change the error code to whatever you want it to be instead of 403. -- Osama Elnaggar On February 22, 2017 at 6:56:38 AM, Briand, Sheldon (NRC/CNRC) ( sheldon.bri...@canada.ca) wrote: Hi, I’m wondering how to best setup the CRS 3 rules to allow modsecurity to return the correct error code in the response. The error message I don’t need just the error code that was triggered instead of a 403 every time. I am running in self-contained mode. Is this possible? Thanks, -Sheldon Sheldon Briand Computer Systems and Applications Analyst National Research Council/Government of Canada sheldon.bri...@canada.ca/ Tel: (902) 426-1677 _______________________________________________ Owasp-modsecurity-core-rule-set mailing list Owasp-modsecurity-core-rule-set@lists.owasp.org https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
_______________________________________________ Owasp-modsecurity-core-rule-set mailing list Owasp-modsecurity-core-rule-set@lists.owasp.org https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
