Modsecurity is a great tool to find data leakage issues in the response body. For my current project, I want to detect data leakage issues with a configured response body size set via SecResponseBodyLimit and the action for response body greater than this limit set to ProcessPartial.
This works as expected however, I would like to log response which is greater than the set limit. Is there any way to do it?
ModSecurity sets a variable named OUTBOUND_DATA_ERROR to 1 whenever the response size is above the setting configured in SecResponseBodyLimit. Thus a simple rule that checks this variable can be used to achieve the requirement.
Example:
SecRule OUTBOUND_DATA_ERROR "@eq 1" "id:124,phase:4,t:none,log,msg:'DATA_OVERFLOW'"