Support for session, ip, global collections, and custom variables #1227
Description
Summary
Coraza doesn’t support predefined collections like session, ip, and global, or allow users to define their own custom collections or variables. These are super useful for tracking things like user sessions, rate limits by IP, or even global counters across transactions. Adding support for this would make Coraza way more flexible and bring it closer to ModSecurity in terms of what’s possible.
Basic example
This feature allows the IP-based restrictions like this:
# Initialize the IP collection
SecAction "id:2000,phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR}"
# Increment request count for this IP
SecAction "id:2001,phase:2,nolog,pass,setvar:ip.request_count=+1"
# Block IP after 100 requests
SecRule IP:request_count "@ge 100" \
"id:2002,phase:2,deny,log,msg:'Rate limit exceeded for IP'"Or session-based, like this:
# Initialize login attempts counter for the session
SecAction "id:1001,phase:1,nolog,pass,setvar:session.login_attempts=0"
# Increment login attempts on failed login
SecRule ARGS:username ".*" \
"id:1002,phase:2,chain,pass,nolog"
SecRule ARGS:password "!@eq secret" \
"setvar:session.login_attempts=+1"
# Block the session after 5 failed login attempts
SecRule SESSION:login_attempts "@ge 5" \
"id:1003,phase:2,deny,log,msg:'Too many login attempts in session'"Motivation
Why this could be useful?
- Session management: Track login attempts, session tokens, or anything related to a user.
- IP-based logic: Rate-limit or block specific IPs.
- Global counters: Count something across all requests, like total hits or error counts.
- Customization: Let users define their own variables and collections to handle whatever logic they need.
Without these features, Coraza misses out on some of the more advanced use cases that ModSecurity handles out of the box. Adding them would make it much more powerful and easier to adopt for users migrating from ModSecurity.