我们在应用服务器上安装了 ModSecurity,有时请求被阻止,因为 ModSecurity 检测到 PHPSESSID cookie 上的 SQL 注入。
GET /somepage.php HTTP/1.1
主机:www.domain.com
用户代理:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:26.0) Gecko/20100101 Firefox/26.0
接受:text/html,application/xhtml +xml,application/xml;q=0.9, / ;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=peu4e3ftt 241or q5nbnuc6ocs4
Connection: keep-alive消息:使用代码 403(第 2 阶段)拒绝访问。[file "C:/Program Files/Apache Software Foundation/Apache2.2/conf/extra/modsecurity_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "539"] [id "981248"] [msg "检测链接的 SQL 注入尝试1/2"] [数据“ 241 或”] [严重性“CRITICAL”] [标记“WEB_ATTACK/SQLI”] [标记“WEB_ATTACK/ID”]
有什么建议可以避免这种误报?