When identifying false positives with my Drupal 7 site running ModSecurity CRS 3.1, I noticed visitors were getting denied access to a page because that page loaded an image using itok?= which had 2 -- in it.


This was responsible for triggering ModSecurity rule:

942100 [msg "SQL Injection Attack Detected via libinjection]

Is it possible to define the characters Drupal generates for itok, without editing Drupal's Core, to exclude keyword specific characters like the-?

Thank you.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.