LWN: Comments on "ModSecurity for web-application firewalls"

ModSecurity for web-application firewalls

dune73 — Sun, 18 Dec 2016 04:57:27 +0000

It is tempting to do the full input validation via ModSecurity rules. But the client and the application are in a much better position to do so.

Not having a surname is a typical example. It's up to the application to decide what to do with such a registration. ModSecurity should concentrate on security and leave people without a surname alone.

ModSecurity for web-application firewalls

anselm — Sat, 17 Dec 2016 11:15:22 +0000

Actually, people may not even have surnames. Fortunately the original regex takes that into account; let's hope that the actual application does, too.

ModSecurity for web-application firewalls

dune73 — Sat, 17 Dec 2016 04:50:10 +0000

Sure thing. It's a simple example with a simple regex.

The real world rules for free text fields are a bit more complex.

ModSecurity for web-application firewalls

smurf — Fri, 16 Dec 2016 16:49:33 +0000

Surnames may have spaces, non-ASCII letters, apostrophes, and whatnot. Summary: Please don't do that.