{"id":20603829,"url":"https://github.com/owasp-modsecurity/modsecurity-apache","last_synced_at":"2025-08-30T17:06:34.032Z","repository":{"id":47081245,"uuid":"43653366","full_name":"owasp-modsecurity/ModSecurity-apache","owner":"owasp-modsecurity","description":"ModSecurity v3 Apache Connector","archived":false,"fork":false,"pushed_at":"2021-09-14T12:49:20.000Z","size":242,"stargazers_count":93,"open_issues_count":30,"forks_count":50,"subscribers_count":25,"default_branch":"master","last_synced_at":"2025-04-22T03:28:18.901Z","etag":null,"topics":["apache","apache2","libmodsecurity","modsecurity","waf"],"latest_commit_sha":null,"homepage":null,"language":"Perl","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/owasp-modsecurity.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGES","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-10-04T21:25:32.000Z","updated_at":"2025-04-17T00:37:52.000Z","dependencies_parsed_at":"2022-09-03T16:20:44.428Z","dependency_job_id":null,"html_url":"https://github.com/owasp-modsecurity/ModSecurity-apache","commit_stats":null,"previous_names":["owasp-modsecurity/modsecurity-apache","spiderlabs/modsecurity-apache"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/owasp-modsecurity/ModSecurity-apache","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/owasp-modsecurity%2FModSecurity-apache","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/owasp-modsecurity%2FModSecurity-apache/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/owasp-modsecurity%2FModSecurity-apache/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/owasp-modsecurity%2FModSecurity-apache/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/owasp-modsecurity","download_url":"https://codeload.github.com/owasp-modsecurity/ModSecurity-apache/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/owasp-modsecurity%2FModSecurity-apache/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":272878320,"owners_count":25008336,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-30T02:00:09.474Z","response_time":77,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apache","apache2","libmodsecurity","modsecurity","waf"],"created_at":"2024-11-16T09:18:48.552Z","updated_at":"2025-08-30T17:06:33.979Z","avatar_url":"https://github.com/owasp-modsecurity.png","language":"Perl","readme":"\n\u003cimg src=\"https://github.com/SpiderLabs/ModSecurity/raw/v3/master/others/modsec.png\" width=\"50%\"\u003e\n\n[![Build Status](https://travis-ci.org/SpiderLabs/ModSecurity-apache.svg?branch=master)](https://travis-ci.org/SpiderLabs/ModSecurity-apache)\n[![](https://raw.githubusercontent.com/ZenHubIO/support/master/zenhub-badge.png)](https://zenhub.com)\n\n\nThe ModSecurity-apache connector is the connection point between Apache and libmodsecurity (ModSecurity v3). Said another way, this project provides a communication channel between Apache and libmodsecurity. This connector is required to use LibModSecurity with Apache.\n\nThe ModSecurity-apache connector takes the form of an Apache module. The module simply serves as a layer of communication between Apache and ModSecurity.\n\nNotice that this project depends on libmodsecurity rather than ModSecurity (version 2.9 or less).\n\n\n### NOTE:  This project is not production ready\n\nThis project should be considered under development and not production ready.  The functionality is not complete and so should not be used.  With Apache HTTP Server, the recommended version of ModSecurity is v2.9.x.\n\n\n### What is the difference between this project and the old ModSecurity module for Apache?\n\nThe old version of ModSecurity was originally designed for and contained within an Apache module. This current version abstracts out some of the details allowing ModSecurity to more easily support multiple platforms and features beyond the scope of what Apache internals currently support. As a result using the new libmodsecurity engine is no longer reliant on the use of Apache and can be used to power multiple different connectors. As a result of this the current version is more flexible, has wider support, and allows for the support of new functionality that was not previously possible.\n\n\n# Compilation\n\nBefore you compile this software make sure that you have libmodsecurity installed.\nYou can download it from the ModSecurity git repository. For information pertaining to the compilation and installation of libmodsecurity please consult the documentation provided along with it.\n\nWith libmodsecurity installed, you can proceed with the installation of the ModSecurity-apache connector. Run the following commands:\n\n```\n$ ./autogen.sh\n$ ./configure\n$ make\n$ sudo make install\n```\n\n# Usage\n\nlibModSecurity for Apache extends your configuration directives. In order to load the module into Apache add the following directive to your Apache configuration:\n\n```\nLoadModule security3_module modules/mod_security3.so\n```\n\nThe module adds new directives to Apache and some of them are documented below:\n\nmodsecurity\n-----------\n**syntax:** *modsecurity on | off*\n\n**context:** *http, server, location*\n\n**default:** *off*\n\nTurns on or off the ModSecurity functionality.\nNote that this configuration directive is no longer related to the SecRule state.\nInstead, it now serves solely as an Apache flag to enable or disable the module.\n\nmodsecurity_rules_file\n----------------------\n**syntax:** *modsecurity_rules_file \u0026lt;path to rules file\u0026gt;*\n\n**context:** *http, server, location*\n\n**default:** *no*\n\nSpecifies the location of the ModSecurity configuration file, e.g.:\n\n```\nmodsecurity on\nmodsecurity_rules_file /etc/my_modsecurity_rules.conf;\n```\n\nmodsecurity_rules_remote\n------------------------\n**syntax:** *modsecurity_rules_remote \u0026lt;key\u0026gt; \u0026lt;URL to rules\u0026gt;*\n\n**context:** *http, server, location*\n\n**default:** *no*\n\nSpecifies from where (on the internet) a modsecurity configuration file will be downloaded.\nIt also specifies the key that will be used to authenticate to that server:\n\n```\nmodsecurity on\nmodsecurity_rules_remote my-server-key https://my-own-server/rules/download;\n```\n\nmodsecurity_rules\n-----------------\n**syntax:** *modsecurity_rules \u0026lt;modsecurity rule\u0026gt;*\n\n**context:** *http, server, location*\n\n**default:** *no*\n\nAllows for the direct inclusion of a ModSecurity rule into the Apache configuration.\nThe following example is loading rules from a file and injecting specific configurations per directory/alias:\n\n```\nTODO\n```\n\nmodsecurity_transaction_id\n--------------------------\n**syntax:** *modsecurity_transaction_id string*\n\n**context:** *http, server, location*\n\n**default:** *no*\n\nAllows to pass transaction ID from Apache instead of generating it in the library.\nThis can be useful for tracing purposes, e.g. consider this configuration:\n\n```\nTODO\n```\n\n# Contributing\n\nAs an open source project we invite (and encourage) anyone from the community to contribute to our project. This may take the form of: new\nfunctionality, bug fixes, bug reports, beginners user support, and anything else that you\nare willing to help with. Thank you.\n\n## Providing Patches\n\nWe prefer to have your patch within the GitHub infrastructure to facilitate our\nreview work, and our QA integration. GitHub provides an excellent\ndocumentation on how to perform “Pull Requests”. More information available\nhere: https://help.github.com/articles/using-pull-requests/\n\nPlease respect the coding style in use. Pull requests can include various commits, so provide one fix or one piece of functionality per commit. Please do not change anything outside the scope of your target work (e.g. coding style in a function that you have passed by). For further information about the coding style used in this project, please check: https://www.chromium.org/blink/coding-style\n\n### Don’t know where to start?\n\nWithin our code there are various items marked as TODO or FIXME that may need\nyour attention. Check the list of items by performing a grep:\n\n```\n$ cd /path/to/modsecurity-apache\n$ egrep -Rin \"TODO|FIXME\" -R *\n```\n\nYou may also take a look at recent bug reports and open issues to get an idea of what kind of help we are looking for.\n\n### Testing your patch\n\nAlong with the manual testing, we strongly recommend that you to use the Apache test\nutility to make sure that you patch does not adversly affect the behavior or performance of Apache.\n\nThe Apache testing tools are available on: http://httpd.apache.org/test/\n\nTo use those tests ....\n #TODO#\n\nIf you are facing problems getting your added functionality to pass all the  Apache tests, feel free to contact us or the Apache mailing list at: http://httpd.apache.org/lists.html\n\n### Debugging\nBecause the ModSecurity Apache Connector runs as part of Apache, one needs to debug the Apache process. Debugging may require several steps. In general debugging can be enabled by compiling the Apache connector with debugging as follows:\n```CFLAGS=\"-g -O0\" ./configure ...normal configure parameters...)```\n\nIt is recommended that one keeps the debugging process as simple as possible, to do so, the elimination of features such as multi-threading by the HTTP server is recommended. A special \"--with-debug\" option can also be used during the compilation of the Apache Connector that will enable the connector's debug messages.\n\nApache webservers accept a special command line parameter: \"-X\", that starts the server in debug mode and doesn't detach it from the console. This flag should be passed straight to the apache2 or httpd binary, along with any other options, such as the configuration file that should be used. The parameter should not be passed to the apachectl script, instead, the http/apache2 file should be used directly. If you are using Ubuntu your Apache will probably be at: /usr/sbin/apache2. If you are using Fedora this will probably be at: /usr/sbin/httpd.\n\nThis setup may affect the behavior of the HTTP server in a way that makes impossible or more difficult to reproduce a given bug, if this is the case, you may wish to ask for help in our mailing list and check out Apache's debugging instructions at: https://httpd.apache.org/dev/debugging.html.\n\n## Reporting Issues\n\nIf you are facing a configuration issue or if something is not working as you\nexpect it to be, please use ModSecurity user’s mailing list. Issues on GitHub\nare also welcome, but we prefer to have users question on the mailing list first,\nwhere you can reach an entire community. Also don’t forget to look for an\nexisting issue before opening a new one.\n\nLastly, If you are planning to open an issue on GitHub, please don’t forget to tell us the\nversion of your libmodsecurity and the version of the Apache connector you are running.\n\n### Security issue\n\nPlease do not publicly report any security issue. Instead, contact us at:\nsecurity@modsecurity.org to report the issue. Once the problem is fixed we will provide you with credit for the discovery.\n\n## Feature Request\n\nWe would love to discuss any ideas that you may have for a new feature. Please keep in mind this is a community driven project so be sure to contact the community via the mailing list to get feedback first. Alternatively, feel free to open GitHub issues requesting for new features. Before opening a new issue, please check if there is an existing feature request for the desired functionality.\n\n## Packing\n\nHaving our packages in distros on time is something we highly desire. Let us know if\nthere is anything we can do to facilitate your work as a packager.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fowasp-modsecurity%2Fmodsecurity-apache","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fowasp-modsecurity%2Fmodsecurity-apache","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fowasp-modsecurity%2Fmodsecurity-apache/lists"}