owasp-modsecurity / owasp-modsecurity/ModSecurity-nginx

ModSecurity Audit Log Shows 403 or 200, but Nginx Returns 500 or 499 Under High Traffic

Open
#331 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Perl
Stars
1.9k
Forks
312
PR merge metrics
No merged PRs in 30d

Description

I'm encountering an issue where ModSecurity is blocking requests with a 403 status code, but Nginx is returning a 500 error to the client. Additionally, there are cases where ModSecurity returns a 200 status, but Nginx throws a 499 error instead. The ModSecurity audit log shows the expected 403 or 200 status codes, but this is not reflected in the Nginx responses.

This issue tends to occur when I send a large number of requests or simulate a DOS attack. I've included the relevant access, audit, and error logs below for further context.

Any guidance on why these discrepancies are happening under high traffic conditions and how to resolve them would be greatly appreciated.

access_log.json
audit_log.json
error_log.txt

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing access_log.json, audit_log.json, and error_log.txt for the same requests under high traffic. Reproduce the discrepancy with a large request volume or DOS simulation, then document why ModSecurity's 403 or 200 differs from Nginx's 500 or 499 and verify the resolution in the logs.

Written by the indexing model from the issue text.

Assessment

Tech stack
nginx
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.