Re: [mod-security-users] SecFilterSelective OUTPUT problem
Brought to you by:
victorhora,
zimmerletw
From: Ivan R. <iv...@we...> - 2006-03-30 16:34:10
|
Eric wrote: > > The problem that I am having is what Error Page is returned. When the content > is comming from apache the Custom error page is returned, but when the content > is coming from the app server the default 404 message is displayed. In both > cases the SecFilter rule is catching the "..." correctly, but its just not > displaying the custom 404 page. > > > Any ideas why the custom page is not being displayed? I think it's an Apache issue, i.e. the ErrorDocument feature is not working correctly. I have noticed it myself, although I am not really sure if it's the same with all versions. Apache has this feature called content filters. When a problem is discovered in output it is the (ModSecurity) filter that is reporting the problem. It seems that Apache does not handle that case correctly. It is something I will look into shortly. In the first instance (e.g. 2.0) I was thinking of enabling ModSecurity to create error pages directly. This would also allow one to use the same error code with different pages, which I think is needed in real life. -- Ivan Ristic, Technical Director Thinking Stone, http://www.thinkingstone.com ModSecurity: Open source Web Application Firewall Apache Security (O'Reilly): http://www.apachesecurity.net |