{"action":"closed","issue":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1202","repository_url":"https://api.github.com/repos/SpiderLabs/ModSecurity","labels_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1202/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1202/comments","events_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1202/events","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/1202","id":172664584,"number":1202,"title":"It doesn't log response bodies","user":{"login":"mohrd","id":4965944,"avatar_url":"https://avatars.githubusercontent.com/u/4965944?v=3","gravatar_id":"","url":"https://api.github.com/users/mohrd","html_url":"https://github.com/mohrd","followers_url":"https://api.github.com/users/mohrd/followers","following_url":"https://api.github.com/users/mohrd/following{/other_user}","gists_url":"https://api.github.com/users/mohrd/gists{/gist_id}","starred_url":"https://api.github.com/users/mohrd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mohrd/subscriptions","organizations_url":"https://api.github.com/users/mohrd/orgs","repos_url":"https://api.github.com/users/mohrd/repos","events_url":"https://api.github.com/users/mohrd/events{/privacy}","received_events_url":"https://api.github.com/users/mohrd/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"zimmerle","id":428268,"avatar_url":"https://avatars.githubusercontent.com/u/428268?v=3","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false},"assignees":[{"login":"zimmerle","id":428268,"avatar_url":"https://avatars.githubusercontent.com/u/428268?v=3","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2016-08-23T10:29:52Z","updated_at":"2016-09-26T16:55:45Z","closed_at":"2016-09-26T16:55:45Z","body":"I'm trying to get response body of every request. (`200` or `500`, etc.)\r\n\r\nBut `mod_security` doesn't put `-E--` part (response body) in every request.\r\n\r\nFor example, for this request:\r\n\r\n**Request Body:**\r\n\r\n    POST /accounts/login/ HTTP/1.1\r\n    Host: localhost:2021\r\n    Connection: keep-alive\r\n    Content-Length: 65\r\n    Accept: application/json, text/javascript, */*; q=0.01\r\n    Origin: http://localhost\r\n    X-Requested-With: XMLHttpRequest\r\n    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36\r\n    Content-Type: application/x-www-form-urlencoded; charset=UTF-8\r\n    Referer: http://localhost/\r\n    Accept-Encoding: gzip, deflate\r\n    Accept-Language: en-US,en;q=0.8,fa;q=0.6\r\n    Cookie: *********\r\n\r\n**Response Headers:**\r\n\r\n    HTTP/1.1 200 OK\r\n    Date: Tue, 23 Aug 2016 09:59:30 GMT\r\n    Server: Apache/2.4.18 (Ubuntu)\r\n    Set-Cookie: ********\r\n    Content-Length: 12\r\n    Keep-Alive: timeout=5, max=100\r\n    Connection: Keep-Alive\r\n    Content-Type: text/html; charset=UTF-8\r\n\r\n**Form Data:**\r\n\r\n    _method=POST&data[username]=username&data[password]=password\r\n\r\nThis is what audit logs:\r\n\r\n    --45fa656f-A--\r\n    [23/Aug/2016:14:29:30 +0430] V7wegn8AAQEAACNhh6IAAAAD 127.0.0.1 50392 127.0.0.1 80\r\n    --45fa656f-B--\r\n    POST /accounts/login/ HTTP/1.1\r\n    Host: localhost\r\n    Connection: keep-alive\r\n    Content-Length: 65\r\n    Accept: application/json, text/javascript, */*; q=0.01\r\n    Origin: http://localhost\r\n    X-Requested-With: XMLHttpRequest\r\n    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36\r\n    Content-Type: application/x-www-form-urlencoded; charset=UTF-8\r\n    Referer: http://localhost/\r\n    Accept-Encoding: gzip, deflate\r\n    Accept-Language: en-US,en;q=0.8,fa;q=0.6\r\n    Cookie: *********\r\n    \r\n    --45fa656f-C--\r\n    _method=POST&data[username]=username&data[password]=password\r\n    --45fa656f-F--\r\n    HTTP/1.1 200 OK\r\n    Set-Cookie: *******\r\n    Content-Length: 12\r\n    Keep-Alive: timeout=5, max=100\r\n    Connection: Keep-Alive\r\n    Content-Type: text/html; charset=UTF-8\r\n    \r\n    --45fa656f-H--\r\n    Apache-Handler: application/x-httpd-php\r\n    Stopwatch: 1471946370098737 633846 (- - -)\r\n    Stopwatch2: 1471946370098737 633846; combined=416, p1=190, p2=217, p3=0, p4=0, p5=9, sr=0, sw=0, l=0, gc=0\r\n    Producer: ModSecurity for Apache/2.9.0 (http://www.modsecurity.org/).\r\n    Server: Apache/2.4.18 (Ubuntu)\r\n    Engine-Mode: \"ENABLED\"\r\n    \r\n    --45fa656f-Z--\r\n\r\n\r\n**Here is config file:**\r\n\r\n    # -- Rule engine initialization ----------------------------------------------\r\n    \r\n    # Enable ModSecurity, attaching it to every transaction. Use detection\r\n    # only to start with, because that minimises the chances of post-installation\r\n    # disruption.\r\n    #\r\n    SecRuleEngine On\r\n    \r\n    \r\n    # -- Request body handling ---------------------------------------------------\r\n    \r\n    # Allow ModSecurity to access request bodies. If you don't, ModSecurity\r\n    # won't be able to see any POST parameters, which opens a large security\r\n    # hole for attackers to exploit.\r\n    #\r\n    SecRequestBodyAccess On\r\n    \r\n    \r\n    # Enable XML request body parser.\r\n    # Initiate XML Processor in case of xml content-type\r\n    #\r\n    SecRule REQUEST_HEADERS:Content-Type \"text/xml\" \\\r\n         \"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML\"\r\n    \r\n    # Enable JSON request body parser.\r\n    # Initiate JSON Processor in case of JSON content-type; change accordingly\r\n    # if your application does not use 'application/json'\r\n    #\r\n    SecRule REQUEST_HEADERS:Content-Type \"application/json\" \\\r\n         \"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON\"\r\n    \r\n    # Maximum request body size we will accept for buffering. If you support\r\n    # file uploads then the value given on the first line has to be as large\r\n    # as the largest file you are willing to accept. The second value refers\r\n    # to the size of data, with files excluded. You want to keep that value as\r\n    # low as practical.\r\n    #\r\n    SecRequestBodyLimit 13107200\r\n    SecRequestBodyNoFilesLimit 131072\r\n    \r\n    # Store up to 128 KB of request body data in memory. When the multipart\r\n    # parser reachers this limit, it will start using your hard disk for\r\n    # storage. That is slow, but unavoidable.\r\n    #\r\n    SecRequestBodyInMemoryLimit 131072\r\n    \r\n    # What do do if the request body size is above our configured limit.\r\n    # Keep in mind that this setting will automatically be set to ProcessPartial\r\n    # when SecRuleEngine is set to DetectionOnly mode in order to minimize\r\n    # disruptions when initially deploying ModSecurity.\r\n    #\r\n    SecRequestBodyLimitAction Reject\r\n    \r\n    # Verify that we've correctly processed the request body.\r\n    # As a rule of thumb, when failing to process a request body\r\n    # you should reject the request (when deployed in blocking mode)\r\n    # or log a high-severity alert (when deployed in detection-only mode).\r\n    #\r\n    SecRule REQBODY_ERROR \"!@eq 0\" \\\r\n    \"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2\"\r\n    \r\n    # By default be strict with what we accept in the multipart/form-data\r\n    # request body. If the rule below proves to be too strict for your\r\n    # environment consider changing it to detection-only. You are encouraged\r\n    # _not_ to remove it altogether.\r\n    #\r\n    SecRule MULTIPART_STRICT_ERROR \"!@eq 0\" \\\r\n    \"id:'200003',phase:2,t:none,log,deny,status:400, \\\r\n    msg:'Multipart request body failed strict validation: \\\r\n    PE %{REQBODY_PROCESSOR_ERROR}, \\\r\n    BQ %{MULTIPART_BOUNDARY_QUOTED}, \\\r\n    BW %{MULTIPART_BOUNDARY_WHITESPACE}, \\\r\n    DB %{MULTIPART_DATA_BEFORE}, \\\r\n    DA %{MULTIPART_DATA_AFTER}, \\\r\n    HF %{MULTIPART_HEADER_FOLDING}, \\\r\n    LF %{MULTIPART_LF_LINE}, \\\r\n    SM %{MULTIPART_MISSING_SEMICOLON}, \\\r\n    IQ %{MULTIPART_INVALID_QUOTING}, \\\r\n    IP %{MULTIPART_INVALID_PART}, \\\r\n    IH %{MULTIPART_INVALID_HEADER_FOLDING}, \\\r\n    FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'\"\r\n    \r\n    # Did we see anything that might be a boundary?\r\n    #\r\n    SecRule MULTIPART_UNMATCHED_BOUNDARY \"!@eq 0\" \\\r\n    \"id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'\"\r\n    \r\n    # PCRE Tuning\r\n    # We want to avoid a potential RegEx DoS condition\r\n    #\r\n    SecPcreMatchLimit 1000\r\n    SecPcreMatchLimitRecursion 1000\r\n    \r\n    # Some internal errors will set flags in TX and we will need to look for these.\r\n    # All of these are prefixed with \"MSC_\".  The following flags currently exist:\r\n    #\r\n    # MSC_PCRE_LIMITS_EXCEEDED: PCRE match limits were exceeded.\r\n    #\r\n    SecRule TX:/^MSC_/ \"!@streq 0\" \\\r\n            \"id:'200005',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'\"\r\n    \r\n    \r\n    # -- Response body handling --------------------------------------------------\r\n    \r\n    # Allow ModSecurity to access response bodies. \r\n    # You should have this directive enabled in order to identify errors\r\n    # and data leakage issues.\r\n    # \r\n    # Do keep in mind that enabling this directive does increases both\r\n    # memory consumption and response latency.\r\n    #\r\n    SecResponseBodyAccess On\r\n    \r\n    # Which response MIME types do you want to inspect? You should adjust the\r\n    # configuration below to catch documents but avoid static files\r\n    # (e.g., images and archives).\r\n    #\r\n    SecResponseBodyMimeType text/plain text/html text/xml application/json\r\n    \r\n    # Buffer response bodies of up to 512 KB in length.\r\n    SecResponseBodyLimit 524288\r\n    \r\n    # What happens when we encounter a response body larger than the configured\r\n    # limit? By default, we process what we have and let the rest through.\r\n    # That's somewhat less secure, but does not break any legitimate pages.\r\n    #\r\n    SecResponseBodyLimitAction ProcessPartial\r\n    \r\n    \r\n    # -- Filesystem configuration ------------------------------------------------\r\n    \r\n    # The location where ModSecurity stores temporary files (for example, when\r\n    # it needs to handle a file upload that is larger than the configured limit).\r\n    # \r\n    # This default setting is chosen due to all systems have /tmp available however, \r\n    # this is less than ideal. It is recommended that you specify a location that's private.\r\n    #\r\n    SecTmpDir /tmp/\r\n    \r\n    # The location where ModSecurity will keep its persistent data.  This default setting \r\n    # is chosen due to all systems have /tmp available however, it\r\n    # too should be updated to a place that other users can't access.\r\n    #\r\n    SecDataDir /tmp/\r\n    \r\n    \r\n    # -- File uploads handling configuration -------------------------------------\r\n    \r\n    # The location where ModSecurity stores intercepted uploaded files. This\r\n    # location must be private to ModSecurity. You don't want other users on\r\n    # the server to access the files, do you?\r\n    #\r\n    #SecUploadDir /opt/modsecurity/var/upload/\r\n    \r\n    # By default, only keep the files that were determined to be unusual\r\n    # in some way (by an external inspection script). For this to work you\r\n    # will also need at least one file inspection rule.\r\n    #\r\n    #SecUploadKeepFiles RelevantOnly\r\n    \r\n    # Uploaded files are by default created with permissions that do not allow\r\n    # any other user to access them. You may need to relax that if you want to\r\n    # interface ModSecurity to an external program (e.g., an anti-virus).\r\n    #\r\n    #SecUploadFileMode 0600\r\n    \r\n    \r\n    # -- Debug log configuration -------------------------------------------------\r\n    \r\n    # The default debug log configuration is to duplicate the error, warning\r\n    # and notice messages from the error log.\r\n    #\r\n    SecDebugLog /tmp/modsecurity_debug.log\r\n    SecDebugLogLevel 9\r\n    \r\n    \r\n    # -- Audit log configuration -------------------------------------------------\r\n    \r\n    # Log the transactions that are marked by a rule, as well as those that\r\n    # trigger a server error (determined by a 5xx or 4xx, excluding 404,  \r\n    # level response status codes).\r\n    #\r\n    SecAuditEngine On\r\n    SecAuditLogRelevantStatus \"^(?:5|4(?!04))\"\r\n    \r\n    # Log everything we know about a transaction.\r\n    SecAuditLogParts ABCIJDEFHZ\r\n    \r\n    # Use a single file for logging. This is much easier to look at, but\r\n    # assumes that you will use the audit log only ocassionally.\r\n    #\r\n    SecAuditLogType Serial\r\n    SecAuditLog /var/log/apache2/modsec_audit.log\r\n    \r\n    # Specify the path for concurrent audit logging.\r\n    #SecAuditLogStorageDir /opt/modsecurity/var/audit/\r\n    \r\n    \r\n    # -- Miscellaneous -----------------------------------------------------------\r\n    \r\n    # Use the most commonly used application/x-www-form-urlencoded parameter\r\n    # separator. There's probably only one application somewhere that uses\r\n    # something else so don't expect to change this value.\r\n    #\r\n    SecArgumentSeparator &\r\n    \r\n    # Settle on version 0 (zero) cookies, as that is what most applications\r\n    # use. Using an incorrect cookie version may open your installation to\r\n    # evasion attacks (against the rules that examine named cookies).\r\n    #\r\n    SecCookieFormat 0\r\n    \r\n    # Specify your Unicode Code Point.\r\n    # This mapping is used by the t:urlDecodeUni transformation function\r\n    # to properly map encoded data to your language. Properly setting\r\n    # these directives helps to reduce false positives and negatives.\r\n    #\r\n    SecUnicodeMapFile unicode.mapping 20127\r\n    \r\n    # Improve the quality of ModSecurity by sharing information about your\r\n    # current ModSecurity version and dependencies versions.\r\n    # The following information will be shared: ModSecurity version,\r\n    # Web Server version, APR version, PCRE version, Lua version, Libxml2\r\n    # version, Anonymous unique id for host.\r\n    SecStatusEngine On\r\n\r\n\r\nWhats wrong? Does it catch response type `text/html; charset=UTF-8`?"}}
{"actor":{"display_login":"zimmerle"}}