Re: [mod-security-users] ModSecurity 2.9.2 Rule Processing Order

[Reindl H. <h.r...@th...>]

Am 12.12.18 um 14:21 schrieb Gryzli Bugbear:
> Thanks for your reply Reindl!
> 
> Could you tell me what do you mean by this: 
>> the rule-ids are in different ranges depedning of context 
> 
> Just to make it clear - I'm using my own rules (not the CRS). 
> 
> Also I didn't find any section in the official documentation stating the
> rule execution order (for a same phase) is actually based no the order
> they are stored in config files, instead of the id

in the past the rule-id wasn't mandatory at all, that changed a few
years ago

executing in id-order wouldn't be helpful

have fun when you have SecRuleRemoveById like below which can also exist
in a <VirtualHost> and need to change ordering

<LocationMatch "^/whatever$">
 SecRuleRemoveById 132
 SecRuleRemoveById 152
 SecRuleRemoveById 958086
 SecRuleRemoveById 958087
 SecRuleRemoveById 950107
</LocationMatch>