[mod-security-users] Re: Mod_security question

[Ivan R. <iv...@we...>]

Spence, Ian (ELS-CAM) wrote:
> Ivan
> 
> Can mod_security check on a token parameter in the URL?
> 
> E.g. _http://server/app?token=digestTokenValue_
> 
> I want the receiving web server to check the token value against an 
> agreed algorithm, for a start it will be MD5 digested.
> 
> I notice with the mod_security rules you can trap on certain parameter 
> values i.e. regex, but given a match can you run a script and then 
> depending on the result of the script, either reject or accept the http 
> request.

   Yes, mod_security can do that. I've added that functionality
   to the 1.9.x branch, so far only in the Apache 1.x version of
   the module. The new directive is called SecFilterExternal and it
   takes only one parameter - the name of the script to execute.

   The script will get the path to the file containing request
   parameters (only that at the moment) as its first parameter.
   Here's an example of a script that uses this feature to interface
   to SpamAssassin:
 
http://cvs.sourceforge.net/viewcvs.py/mod-security/mod_security/util/filter_spamc.pl?rev=1.1&view=auto

   This functionality is still rough and I plan to change the
   data exchange format before the final 1.9.x. version (e.g. to
   include the request headers). But it works and you can play with
   it in the meantime.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org