# Passbolt Modsecurity

**URL:** <https://community.passbolt.com/t/passbolt-modsecurity/3926>\
**Category:** API & Customization issues\
**Created:** [May 22, 2021, 10:27pm UTC](https://community.passbolt.com/t/passbolt-modsecurity/3926 "2021-05-22T22:27:32Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![dim](https://avatars.discourse-cdn.com/v4/letter/d/ebca7d/32.png) [@dim](https://community.passbolt.com/u/dim)\
**Post date:** [May 30, 2021, 3:17pm UTC](https://community.passbolt.com/t/passbolt-modsecurity/3926/4 "2021-05-30T15:17:35Z")

</div>

Im in the process of testing. I have put modsecurity on my server today and on default settings with no configuration it broke passbolt.

First test, I added:

`SecRuleEngine DetectionOnly`

To /etc/apache2/sites-enabled/passbolt.conf

To turn modsecurity off entirely for the passbolt virtual host, and then passbolt worked normally. So on default settings modsecurity certainly breaks things.

Second test, using the instructions from here, [ModSecurity Configuration for Passbolt | Michael A. Mead](https://www.michaelamead.com/uncategorized/modsecurity-configuration-for-passbolt/#:~:text=ModSecurity%20is%20a%20module%20for,are%20allowed%20when%20accessing%20Apache). I added,

```auto
<Location "/auth/verify.json">
        SecRuleRemoveById 200004 942100
</Location>

<Location "/import/resources.json">
        SecRuleRemoveById 942100
</Location>

<Location "/resources.json">
        SecRuleRemoveById 942100
</Location>

<LocationMatch "^/resources/.*">
        SecRuleRemoveById 911100 980130 942100
</LocationMatch>

<LocationMatch "^/users/.*">
        SecRuleRemoveById 911100
</LocationMatch>

<LocationMatch "^/setup/completeRecovery/.*\.json">
        SecRuleRemoveById 980130 911100 949110
</LocationMatch>

```

To /etc/apache2/sites-enabled/passbolt.conf

then restarting apache2

`sudo systemctl restart apache2`

and at the moment passbolt is still working as expected…

And if i try to be nasty, its 403’ing as it should

![image](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/1X/715211576097695464df65076f3c7b9c15629d77.png)]

need a 403 page for passbolt though

---

_[View the full topic](https://community.passbolt.com/t/passbolt-modsecurity/3926)._