SpiderLabs/owasp-modsecurity-crs — pull request #171 by th3m1773n (2014-03-05 21:08:54+00:00)
Title: Enable embedded mode, Session test before setvars

**Issue 1**
The last two rules (981063 and 981064, lines 47 and 49) will try to setvar even when the SESSION collection hasn't yet been initialized (e.g. for session-less users, like bots or anonymous users).
This results in two "collection does not exist" errors per transaction.

**Issue 2**
I also noticed that because I run Modsecurity in embedded mode, a lot of response headers aren't yet released" by Apache on phase 3.
That includes the **Set-Cookie header**, which is vital for rule 981062 (Session initialization).

Proposed resolution:

- Move execution of rules 981062 (Session creation), 981063 and 981064 (IP and UA Hash creation) to phase 5:
Since they are all non-disruptive, and because the Set-Cookie response headers are only available at the logging phase for embedded installs, this enables successful session initialization for all install modes.

- Execute rules 981063 and 981064 with a session existence test:
* That way, IP and UA hashes are only created for an existing session, or one that was just created by the previous 981062 rule, and there are no more errors for session-less navigation.
* Proposed session existence test:
SecRule &SESSION:SESSIONID "@eq 1" "chain..."
* Apparently, it's important that this test be the first in chain, so as to prevent the errors showing up (maybe the rule is parsed without being executed when further down the chain? I'm not sure...)