Have someone installed Discourse behind nginx/Apache with ModSecurity and CRS v3? Is there any known list of rules to disable or modify for Discourse? For now we have disabled ~11 rules and I think that is not the end.

Nobody can promise will full confidence that their software doesn’t contain vulnerabilities. We do however patch security issues promptly and responsibly when reported, and have a bug bounty program. Having said that, ModSecurity is not the answer. You will have a very hard time if you choose to do…

Why would you use that? Discourse is open source and with way more activity than ModSecurity, which sounds like something useful when put to front some black box web software.

I promise you this will end very badly for everyone involved. It is not a good idea.

Thank you for the answers. We will consider removing ModSecurity.

ModSecurity 例外

サポート

szogoon (Przemek Malolepszy) 2019 年 8 月 8 日午前 7:29 4

So you are telling me that introducing WAF will only create new troubles and Discourse doesn’t contain any vulnerabilities?

「いいね！」 1

トピック		返信	表示
Discourse + Web Application Firewall (WAF) mod_security Self-hosting unsupported-install , hosting	8	3596	2019 年 11 月 20 日
How to run Discourse in Apache vhost, not Nginx Self-hosting unsupported-install	30	2391	2023 年 8 月 14 日
Akamai WAF configuration and false positive Support	2	147	2025 年 3 月 31 日
Cloudflare Security WAF (Web Application Firewall) + Discourse? Support	1	445	2025 年 6 月 25 日
How secure is Discourse? Support	11	5841	2019 年 5 月 15 日

ModSecurity 例外

関連トピック