ModSecurity Variables Automatically Expire After 1 Minute Without ExpireVar Setting

[takumi-ricoh]

Describe the bug

Variables created using setvar in ModSecurity rules are being automatically deleted after 1 minute, even without explicitly setting expirevar. This occurs when trying to implement custom rules for login attempt tracking without using CRS.

Steps to reproduce

1. Use the official OWASP ModSecurity CRS Docker image (owasp/modsecurity-crs:4.7.0-nginx-202410090410)
2. Override /etc/nginx/templates/modsecurity.d/setup.conf.template with custom configuration:
   • Comment out CRS includes:

     # Include /etc/modsecurity.d/owasp-crs/crs-setup.conf
     # Include /etc/modsecurity.d/owasp-crs/rules/*.conf

   • Add custom rule file:

     Include /opt/on_pre_llm/extra_lockout_rule.conf

3. Implement custom rule for tracking login attempts:

   SecRule REQUEST_URI "@beginsWith /console/api/login" \
      "id:100098,phase:1,pass,\
      chain"
      SecRule &IP.failed_attempts "@eq 0" \
      "setvar:IP.failed_attempts=0,\
      setvar:IP.is_locked=0,\
      msg:'Initialization - Failed attempts: %{IP.failed_attempts}'"

4. Wait for 1 minute
5. Make another request to the login endpoint

Expected behaviour

• The IP.failed_attempts and IP.is_locked variables should persist indefinitely until explicitly cleared
• The initialization message should only appear on the first request when the variables don't exist

  Actual behaviour

• Variables are automatically deleted after 1 minute
• The initialization message appears again after 1 minute, indicating that the variables have been reset
• This behavior occurs with both IP and GLOBAL collection variables
• No expirevar is explicitly set in the rules

Additional context

• This issue prevents implementing proper login lockout functionality as the attempt counter keeps resetting
• Confirmed that custom rules are working as the messages appear in the Docker logs
• CORS is not active and not related to this issue

Your Environment

• CRS version: Not using CRS (disabled)
• Paranoia level setting: N/A (custom rules only)
• ModSecurity version: As included in owasp/modsecurity-crs:4.7.0-nginx-202410090410
• Web Server and version: nginx (version from Docker image)
• Operating System and version: Ubuntu 24.04
• Docker image: owasp/modsecurity-crs:4.7.0-nginx-202410090410 (sha256:e47fa10fc4d2fad9dbf80cbd8b230d749b27538fda659eb89fbb5ad6f70f8fd4)

[takumi-ricoh]

https://github.com/coreruleset/modsecurity-crs-docker/issues/299