I am trying to show a custom error page when Apache/ModSecurity rules are triggered. My plan is as follows:
- Change the status code for all rules to (for example) 501
- use
ErrorDocument
directive to display a custom error page for this code - Use php in the error page to log the error at application level, show customized message, etc.
What I have tried so far:
SecRuleUpdateActionById 1-999999 "phase:2,status:501"
and
SecDefaultAction "deny,log,redirect:http://some.url/"
I tried those in modsecurity.conf
before and after including CRS rules, as well as .htaccess
.
Doesn't work - still get a 403 error at all times.