Embed Notice

@pfefferle@mastodon.social

Just to follow up on this.

Using this:
https://blog.rac.me.uk/tag/owasp3/

I updated '/etc/modsecurity/crs-setup.conf'

Searched for rule '900220'

And added (rather than uncomment the existing rule):
SecAction \
"id:900220,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json| |application/octet-stream| |application/csp-report| |application/xss-auditor-report| |text/plain| |application/activity+json|'"

Confirmed that ModSecurity was still enable:
/etc/modsecurity/modsecurity.conf

# SecRuleEngine DetectionOnly
SecRuleEngine On

Restarted Apache.

And now I can follow / unfollow the author at will.

Thank you for pointing me to this.

Cheers!