Open drmuey opened 3 years ago
@drmuey Apache version for 3.0 is not yet ready for production. Please use the version 2.x
In order to get the real IP to appear in the ModSecurity audit log, I've come up with the workaround of adding it to a header before the RemoteIP module takes effect ModSecurity reads the headers (but apparently after the RemoteIP module takes effect):
RequestHeader append X-Connecting-IP "%{REMOTE_ADDR}s" early
It's admittedly a hack, and the documentation discourages use of the early
option, but it's working for me. YMMV.
RemoteIPHeader X-Forwarded-For
Our friends at immunify 360 who noticed this may have more detailed reproduction steps or other info to add.
Note: at this time we have not tried to see is the NGINX connector behaves the same or not.