SecRule REQUEST_HEADERS:Content-Type "text/xml" \

"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"

# Enable JSON request body parser.

# Initiate JSON Processor in case of JSON content-type; change accordingly

# if your application does not use 'application/json'

#

SecRule REQUEST_HEADERS:Content-Type "application/json" \

"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"

# Maximum request body size we will accept for buffering. If you support

# file uploads then the value given on the first line has to be as large

# or log a high-severity alert (when deployed in detection-only mode).

#

SecRule REQBODY_ERROR "!@eq 0" \

"id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"

"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"

# By default be strict with what we accept in the multipart/form-data

# request body. If the rule below proves to be too strict for your

# environment consider changing it to detection-only. You are encouraged

# _not_ to remove it altogether.

#

SecRule MULTIPART_STRICT_ERROR "!@eq 0" \

"id:'200002',phase:2,t:none,log,deny,status:400, \

"id:'200003',phase:2,t:none,log,deny,status:400, \

msg:'Multipart request body failed strict validation: \

PE %{REQBODY_PROCESSOR_ERROR}, \

BQ %{MULTIPART_BOUNDARY_QUOTED}, \

# Did we see anything that might be a boundary?

#

SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \

"id:'200003',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"

"id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"

# PCRE Tuning

# We want to avoid a potential RegEx DoS condition

# MSC_PCRE_LIMITS_EXCEEDED: PCRE match limits were exceeded.

#

SecRule TX:/^MSC_/ "!@streq 0" \

"id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"

"id:'200005',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"

# -- Response body handling --------------------------------------------------