This is the finished ruleset to protect the YaBB forum using a positive security model:
<Location /yabb/> # Cookie check SecRule REQUEST_COOKIES_NAMES "!^Y2(Pass|Sess|User)-10491$" \ "deny,msg:'Bad cookie name'" SecRule REQUEST_COOKIES:Y2Pass-10491 "!^[0-9a-zA-Z]+$" \ "deny,msg:'Bad password cookie value'" SecRule REQUEST_COOKIES:Y2Sess-10491 "!^[0-9a-zA-Z]+$" \ "deny,msg:'Bad session cookie value'" SecRule REQUEST_COOKIES:Y2User-10491 "!^[-_0-9a-zA-Z+.]+$" \ "deny,msg:'Bad user cookie value'" # Header check SecRule REQUEST_HEADERS_NAMES "!^(Accept|Referer|Accept-Language|Content-Type|Content-Length|Cookie|User-Agent|Accept-Encoding|Host|Connection|Pragma|If-Modified-Since|If-None-Match)$" \ "deny,msg:'Unknown request header'" SecRule REQUEST_HEADERS:Accept "!^[-\w\s*/,.]+$" \ "deny, msg:'Bad Accept header'" SecRule REQUEST_HEADERS:Referer "!^[-\w\s*/:^.?=~;]+$" \ "deny,msg:'Bad Referer header'" SecRule REQUEST_HEADERS:Accept-Language "!^[-\w*/]+$" \ "deny,msg...
