mod_security blocks redirects (to non-www and https)

Question

httpd-vhosts.conf

    <VirtualHost *:80>
        ServerName example.com
        ServerAlias www.example.com
        DocumentRoot "c:/web/www/mysite"
    Alias /.well-known c:/web/www/mysite/.well-known
Redirect permanent / https://example.com [L,R=301]
    </VirtualHost>

httpd-ssl.conf

        <VirtualHost *:443>
    
    ServerName example.com
    
    SSLEngine on
    SSLCertificateFile "C:/web/cert/example.com-chain.pem"
    SSLCertificateKeyFile "C:/web/cert/example.com-key.pem"
        DocumentRoot "c:/web/www/mysite"
        <Directory  "c:/web/www/mysite/">
            Options  +Includes +FollowSymLinks +MultiViews
            AllowOverride All
            Order Deny,Allow
            Allow from all
            Require all granted
        </Directory>
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header always set Expect-CT "enforce, max-age=300, report-uri='https://example.com/'"
    Header set Access-Control-Allow-Origin "*"
    Header set X-Frame-Options: "SAMEORIGIN"
    Header set X-Content-Type-Options: "nosniff"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "no-referrer"
    
    </VirtualHost>
    
    #
    
    <VirtualHost *:443>
    ServerName www.example.com
    
    SSLEngine on
    SSLCertificateFile "C:/web/cert/www.example.com-chain.pem"
    SSLCertificateKeyFile "C:/web/cert/www.example.com-key.pem"
        DocumentRoot "c:/web/www/mysite"
        <Directory  "c:/web/www/mysite/">
            Options  +Includes +FollowSymLinks +MultiViews
            AllowOverride All
            Order Deny,Allow
            Allow from all
            Require all granted
        </Directory>
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header always set Expect-CT "enforce, max-age=300, report-uri='https://example.com/'"
    Header set Access-Control-Allow-Origin "*"
    Header set X-Frame-Options: "SAMEORIGIN"
    Header set X-Content-Type-Options: "nosniff"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "no-referrer"
    
Redirect permanent / https://example.com [L,R=301]
    </VirtualHost>

Without mod_security2 everything works without problems. When mod_security2 is on redirects are blocked (403). When I add to httpd.conf

SecRuleRemoveById 959100

Redirects works again. Please help, as I know it is not safe to remove this rule. # all headers doesn't change anything.

Logs: https://drive.google.com/file/d/1AD42nQw27MPpZl9GEwioDtW2DpKBWRAL/view?usp=sharing

mod_security blocks redirects (to non-www and https)

0 Answers0