owasp-modsecurity / owasp-modsecurity/ModSecurity-nginx
ModSecurity Audit Log Shows 403 or 200, but Nginx Returns 500 or 499 Under High Traffic
Nobody has claimed this yet.
- Dominant language
- Perl
- Stars
- 1.9k
- Forks
- 312
- PR merge metrics
- No merged PRs in 30d
Description
I'm encountering an issue where ModSecurity is blocking requests with a 403 status code, but Nginx is returning a 500 error to the client. Additionally, there are cases where ModSecurity returns a 200 status, but Nginx throws a 499 error instead. The ModSecurity audit log shows the expected 403 or 200 status codes, but this is not reflected in the Nginx responses.
This issue tends to occur when I send a large number of requests or simulate a DOS attack. I've included the relevant access, audit, and error logs below for further context.
Any guidance on why these discrepancies are happening under high traffic conditions and how to resolve them would be greatly appreciated.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing access_log.json, audit_log.json, and error_log.txt for the same requests under high traffic. Reproduce the discrepancy with a large request volume or DOS simulation, then document why ModSecurity's 403 or 200 differs from Nginx's 500 or 499 and verify the resolution in the logs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100