Consider the following redirect SecRule which is activated from a Lua script
SecRule &TX:SQLI "@eq 1" "id:'129793',phase:2,t:none,redirect:http://www.example.com/failed.html,msg:'SQLi Injection Payload Found',setvar:REQUEST_HEADERS:Blocked"
When the variable tx.sqli
is given a value the rule is activated. The redirection is successful, but the rule attempts to create a new "Blocked" request header. However, the creation is unsuccessful.
The log in the debugger outputs the following:
Could not set variable "REQUEST_HEADERS.Blocked" as the collection does not exist.
This is obviously incorrect. How does Modsecurity create new request header?