Repository navigation
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
When a rule with a redirect action matches during the request phases, the core engine stores the target URI in the "Location" header of the fake request_rec headers_out table and perform_interception() returns the redirect status. The IIS module only forwarded the status code to the IIS response, so clients received a 301/302 without a Location header and the redirect never happened. Read the Location header from headers_out and set it on the IIS response object when a request-phase intervention occurs. Fixes owasp-modsecurity#729 The response-phase (OnSendResponse) path is handled separately, since response phases currently never run on this connector.
b413e8b to
b9a1758
Compare
|
|
Hi @A13501350, thanks for this patch - could you add a new test case to the existing regression tests collection? Thanks! |
This branch has not been deployed
3 participants
Summary
When a rule with a
redirectaction matches during the request phases, the core engine stores the target URI in theLocationheader of the fakerequest_rec'sheaders_outtable andperform_interception()returns theredirect status. The IIS module only forwarded the status code to the IIS response, so clients received a 301/302 without a
Locationheader and the redirect never happened.This fix reads the
Locationheader fromheaders_outand sets it on the IIS response object when a request-phase intervention occurs (OnBeginRequest).Fixes #729
Scope note
Response-phase (OnSendResponse) redirect handling requires further work on the IIS engine pipeline and is left for a follow-up issue.