Variables

This section contains the variables available for use in rule writing. Some variables are actually collections—this is indicated in the description.

ARGS

A collection containing the arguments passed in the request. This includes both, arguments passed via the query string (for example, in the form GET /?name=value) as well as those passed via POST requests.

Example: ARGS:username

Note that the collection only contains the value parts of the arguments. To get access to the name parts, use ARGS_NAMES. ARGS can be used on its own (without specifying a name), in which case it refers to all argument values.

ARGS_COMBINED_SIZE

The combined size of all arguments. In the example where the arguments are name=value, the combined size would be 9.

ARGS_NAMES

A collection containing the name parts of the name=value pairs of the arguments. ARGS_NAMES can be used by itself, in which case it refers to all of the name parts in the passed argument list.

ARGS_GET

A collection containing only argument values passed in a GET request.

ARGS_GET_NAMES

A collection containing only argument names passed in a GET request.

ARGS_POST

A collection containing only argument values passed in a POST request. Only available if SecRequestBodyAccess has been set to On.

ARGS_POST_NAMES

A collection containing only the argument names passed in a POST request. Only available if SecRequestBodyAccess has been set to On.

AUTH_TYPE

Contains the authentication method used to validate a user (for example, Basic, Digest).

ENV

A collection that contains the value of variables previously set using the setenv action.

FILES

A collection with the names of the files that were uploaded as part of a POST request, as they appeared on the client's system.

FILES_COMBINED_SIZE

The combined total size of any uploaded files.

FILES_NAMES

Contains a list of the form fields used for file uploads.

FILES_SIZES

A collection containing the file sizes of any intercepted files uploaded via a HTTP POST request.

FILES_TMPNAMES

A collection containing the filenames of any intercepted files uploaded via a HTTP POST request.

GEO

A collection that is initialized when you use the @geoLookup operator. Only works when you have a geographical database in place. For more information and all the fields contained in this collection, see the section GEO Collection Fields in Chapter 2.

HIGHEST_SEVERITY

Contains the highest severity of the rules that have matched so far, as specified by using the severity action in rules. The value is set to 255 if no severity has been set by any rules.

MATCHED_VAR

The value of the variable that was matched.

MATCHED_VAR_NAME

The name of the variable that was matched.

MODSEC_BUILD

Contains the ModSecurity build number. You can use this in conjunction with the skipAfter action to ensure that a ModSecurity rule is only used if the current ModSecurity can handle the syntax of the rule.

MULTIPART_CRLF_LF_LINES

Set to 1 when a client mixes the use of CRLF and LF as line terminators in a multi-part POST request.

MULTIPART_STRICT_ERROR

Set to 1 if a multi-part POST request is formatted in a non-standard way. This can be a sign of someone trying to evade the web application firewall.

MULTIPART_UNMATCHED_BOUNDARY

Set to 1 when ModSecurity detects that a multipart POST request contains an unmatched boundary.

PATH_INFO

Contains the additional path info passed to a dynamic web page.

QUERY_STRING

The full query string. To access individual name/value pairs in the query string, use the ARGS or ARGS_GET collection.

REMOTE_ADDR

The remote user's IP address.

REMOTE_HOST

If the Apache configuration directive HostNameLookups is set to On then this contains the remote user's hostname, otherwise it contains the remote IP address.

REMOTE_PORT

The port number used on the remote user's end of the connection.

REMOTE_USER

Contains the user name of the authenticated user.

REQBODY_PROCESSOR

The name of the request body processor module used.

REQBODY_PROCESSOR_ERROR

Set to 1 if an error occurs parsing a request body.

REQBODY_PROCESSOR_ERROR_MSG

Error message from the request body parser.

REQUEST_BASENAME

The filename part of a request URI.

Example: If the request URI is /products/index.jsp, REQUEST_BASENAME is set to index.jsp.

REQUEST_BODY

The HTTP request body. Only available in phase 2 and later, and only if SecRequestBodyAccess has been set to On.

REQUEST_COOKIES

A collection containing the cookie data sent by the client.

REQUEST_COOKIES_NAMES

A collection containing the names of the cookies sent by the client.

REQUEST_FILENAME

The filename part of the request, i.e. REQUEST_URI minus any query string.

Example: /index.html

REQUEST_HEADERS

A collection containing all the request headers sent by the client.

Example usage: SecRule REQUEST_HEADERS:User-Agent

REQUEST_HEADERS_NAMES

A collection containing the names of the request headers sent, for example the Host part of the header Host: www.example.com.

REQUEST_LINE

The complete request line sent by the client.

Example: GET / HTTP/1.1

REQUEST_METHOD

The HTTP request method used by the client, for example GET or POST.

REQUEST_PROTOCOL

The protocol and version number used by the client.

Example: HTTP/1.1

REQUEST_URI

The request URI, including the full query string.

Example: /index.php?username=john

REQUEST_URI_RAW

Almost the same as REQUEST_URI—this variable will also contain the domain name of the server if it was specified in the client's GET request.

Example, http://www.example.com/index.php?username=john.

RESPONSE_BODY

The HTTP response body. The response body is only available in phases 4 and 5, and only if SecResponseBodyAccess is set to On and the response body is of a MIME type for which buffering is enabled (as defined by SecResponseBodyMimeType).

RESPONSE_CONTENT_LENGTH

The response body length in bytes. If ModSecurity cannot determine the size of the response body, this variable is set to 0.

RESPONSE_CONTENT_TYPE

The content type of the HTTP response, for example text/plain.

RESPONSE_HEADERS

The HTTP response headers. Some headers may not be available until phase 5 (logging).

RESPONSE_HEADERS_NAMES

A collection containing the response header names.

RESPONSE_PROTOCOL

Contains protocol information for the response, for example HTTP/1.0.

RESPONSE_STATUS

The HTTP status code for the response. This may not be available in all rule processing phases.

RULE

A collection that gives access to the id, rev, severity, logdata, and msg fields of the rule that triggered the action.

SCRIPT_BASENAME

The filename part of SCRIPT_FILENAME.

Example: login.php

SCRIPT_FILENAME

The full filename to the script (file) that was requested by the client.

Example: /home/www/login.php

SCRIPT_GID

The group ID of the group the owner of the requested file belongs to.

SCRIPT_GROUPNAME

The group name of the group the owner of the requested file belongs to.

SCRIPT_MODE

The permission mode of the requested file (for example, 744).

SCRIPT_UID

The user ID of the owner of the requested file.

SCRIPT_USERNAME

The username of the user that the requested file belongs to.

Example: apache

SERVER_ADDR

The IP address of the web server.

SERVER_NAME

The hostname of the web server. The value of this variable is taken from the Host: header specified by the client when making the HTTP request.

SERVER_PORT

The port number used by the web server.

SESSION

A collection, to be used for storing session data. Available only after the setsid action has been used.

SESSIONID

Contains the value previously set by using the ModSecurity action setsid.

TIME

A string with the current time, formatted as a 24-hour clock (hh:mm:ss).

TIME_DAY

The current day of the month (1-31).

TIME_EPOCH

Number of seconds elapsed since January 1st, 1970. This is known as "Unix time" and is a timestamp that is used by Unix and Linux systems.

TIME_HOUR

The current hour, in 24-hour format (0-23).

TIME_MIN

The current minute (0-59).

TIME_MON

The current month, represented as a number from 0 to 11, where 0 is January and 11 is December.

TIME_SEC

The current second count (0-59).

TIME_WDAY

The current weekday, represented as a number from 0 to 6, where 0 is Sunday and 6 is Saturday.

TIME_YEAR

The current year, in four-digit format, for example, 2009.

TX

This is the transaction collection. It can be used in conjunction with setvar to store data that you need access to later. The data in TX only survives the current transaction.

Example usage: SecRule "secret" "setvar:tx.host=%{REMOTE_HOST}"

USERID

Contains the value previously set by using the ModSecurity action setuid.

WEBAPPID

Contains the value previously set using the SecWebAppId directive.

WEBSERVER_ERROR_LOG

If any error messages were generated by Apache when processing the request, these are available in this string. This variable can only be accessed in phase 5 (logging).

XML

Gives access to XML data passed in the request body. Supports XPath expressions. Useful for securing web services that use the SOAP protocol.