[mod-security-users] Pragma Header requires Cache-Control Header for HTTP/1.1 requests

[Jerry <gm...@ho...>]

I get this warning with one or two small ISPs. I don't think it inconveniences
the user but it does fill up the error log with hundreds of lines.


************************
[Tue Jan 12 11:26:31 2010] [error] [client 91.85.nn.nn] ModSecurity: Warning.
Operator GE matched 5 at TX:anomaly_score. 
[file "/etc/httpd/modsecurity.d/modsecurity_crs_60_correlation.conf"] 
[line "42"] [msg "Transactional Anomaly Score (score 5): Pragma Header 
requires Cache-Control Header for HTTP/1.1 requests."] 
[hostname "mydomain.com"] [uri "/images/layout/footer-bg.png"] 
[unique_id "7QBeLVu6Fg8AAHnnWlUAAAAQ"]
************************

Maybe this is more of a problem with the cache settings in httpd rather than 
the ruleset?

Here is an extract of the httpd.conf file

************************
<Directory />
ExpiresActive On
ExpiresDefault A0
 
# 1 YEAR
<FilesMatch "\.(ico|pdf)$">
ExpiresDefault A9030400
Header append Cache-Control "public"
</FilesMatch>
 
# 1 WEEK
<FilesMatch "\.(jpg|jpeg|png|gif)$">
ExpiresDefault A604800
Header append Cache-Control "public"
</FilesMatch>
 
# 3 HOUR
<FilesMatch "\.(xml|css)$">
ExpiresDefault A10800
Header append Cache-Control "proxy-revalidate"
</FilesMatch>

# 10 Mins
<FilesMatch "\.(html|js)$">
ExpiresDefault A10800
</FilesMatch>

<FilesMatch "\.(php|txt)$">
ExpiresDefault A0
Header set Cache-Control "no-cache, no-store, must-revalidate, max-age=0,
proxy-revalidate, no-transform"
Header set Pragma "no-cache"
</FilesMatch>
</Directory>
************************