{"action":"closed","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/607","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/607/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/607/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/607/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/607","id":181740213,"number":607,"title":"981172 is the source of way too many false positives","user":{"login":"Paladin","id":84123,"avatar_url":"https://avatars.githubusercontent.com/u/84123?v=3","gravatar_id":"","url":"https://api.github.com/users/Paladin","html_url":"https://github.com/Paladin","followers_url":"https://api.github.com/users/Paladin/followers","following_url":"https://api.github.com/users/Paladin/following{/other_user}","gists_url":"https://api.github.com/users/Paladin/gists{/gist_id}","starred_url":"https://api.github.com/users/Paladin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Paladin/subscriptions","organizations_url":"https://api.github.com/users/Paladin/orgs","repos_url":"https://api.github.com/users/Paladin/repos","events_url":"https://api.github.com/users/Paladin/events{/privacy}","received_events_url":"https://api.github.com/users/Paladin/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-10-07T18:43:02Z","updated_at":"2016-10-07T18:48:08Z","closed_at":"2016-10-07T18:48:08Z","body":"After writing exceptions for this rule for too many different cookies found in the wild (Trip Advisor sets at least two cookies that trigger this rule for just one example) I'm prompted to wonder if *anyone* is actually able to use this rule on a production website. These are not cookies my site sets, but rather cookies visitors show up with.\r\n\r\nIs there a known list of exceptions to add, or do people really automatically lock out all visitors that happen to also visit Trip Advisor or one of the many other sites that set cookies that trip this? I'm hesitant to turn it off completely, but I've been running this as detect only for weeks and it seems every day I see more cookies that set this off. (I'm up to 15 so far.)\r\n\r\nThe real problem as far as I'm concerned is once I start writing exceptions, where do I stop? I see so many false positives for this rule anymore my default position on any alert it throws is \"there it goes again\" and not \"caught another one.\"\r\n\r\n"}}
{"actor":{"display_login":"dune73"}}