Question about rule 390616

Sempiterna · **Joined:** Tue Jun 24, 2008 12:05 pm **Posts:** 145

Since october 1st i am receiving a ton of log messages (and people being blocked) about rule 390616:

Quote:

Message: [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "61"] [id "390616"] [rev "2"] [msg "Atomicorp.com WAF Rules: POST request must have a Content-Length header"] [severity "WARNING"] Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS.

This seems to be triggered by my ajax poller that, depending on if there is new data or not, sends back a 304 code (not modified) or the standard response if there is changed data.

What is this rule for exactly? I had to globally disable this rule to stop people from being banned.

mikeshinn · **Posted:** Thu Oct 13, 2011 5:38 pm

I'm on the run to a dinner, so heres the RFC reference this relates to:

http://www.w3.org/Protocols/rfc2616/rfc ... l#sec14.13

Sempiterna · **Joined:** Tue Jun 24, 2008 12:05 pm **Posts:** 145

I assume i can safely disable this rule. It also probably is not an ASL issue. The problem surfaced after i moved from Prototype JS to Jquery JS on October 1st.

mikeshinn · **Posted:** Fri Oct 14, 2011 12:07 pm

Quote:

I assume i can safely disable this rule.

That depends on your applications. If they can not be compromised by this header lacking (so they dont set their buffers correctly) then potentially. I wouldnt assume they can do that.

Quote:

It also probably is not an ASL issue. The problem surfaced after i moved from Prototype JS to Jquery JS on October 1st.

Correct. Its an OLD rule, so its not anything we added recently. Its been there for years. This sounds like your application doesnt do things according to the RFC.

Question about rule 390616

Who is online