View Single Post
  #21 (permalink)  
Old 29-06-2007, 12:42
NickJ NickJ is offline
Chief Technical Officer
 
Join Date: Jun 2007
Posts: 135
Default mod_security

The mod_security is a web application intrusion detection and prevention engine. It operates by 'hook'ing itself into apache and inspecting all requests for your specific ruleset. It can be used to monitor your server with logging or even protect it by denying attacks.

The mod_security module gives Apache Web server increased ability to inspect and process input from Web clients before it's acted on by the scripts or processes waiting for the input.

We understand that these changes will certainly affect your website hosting administration in one way or another. However, our top priority here is to protect our servers and data.

Commenting out a line in a mod_security configuration or exclude affected domain from mod_security restriction is a workaround, but it would be potential increase in site-wide risk for vulnerability to cross-site scripting attack.
A better workaround, does not blindly remove the filter for all applications.
Reply With Quote