The OWASP CRS Response Traffic Policy action enables OWASP (Open Worldwide Application Security Project) CRS (previously Core Rule Set), a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. It aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. CRS provides protection against many common attack categories, including SQL Injection, Cross Site Scripting, Local File Inclusion, etc. The owasp-crs-response action only enables rule processing on outgoing HTTP responses from your endpoint. In addition to this action, we also recommend you enable the OWASP CRS Request action to analyze incoming HTTP requests to your endpoint.

​
Video walkthrough

The video below walks you through ngrok’s OWASP CRS request and response actions in Traffic Policy, which let you add web application firewall protection directly to your ngrok endpoints without changing your existing infrastructure.

​
Configuration Reference

This is the Traffic Policy configuration reference for this action.

​
Supported Phases

on_http_response

​
Type

owasp-crs-response

​
Configuration Fields

​
on_error
string
Required

Behavior if there is an error. Must be one of either “continue” or “halt” (default “halt”)

More information can be found in the Managing Fallback Behavior section.

​
process_body
bool

If false, we do not process rules for the response body. Default is false.

​
exclude_rule_ids
array of integers

List of OWASP CRS rule IDs to exclude from evaluation.

The minimum value is 900000 and the maximum value is 999999.

​
Behavior

This action evaluates rules for response headers and body (when process_body is enabled), and each matching rule adds to the overall score of a response. If the score exceeds the set score threshold, the action will block the response. The tallying process is called Anomaly Scoring, and is detailed on the CRS website.

​
Default Behavior

The default behavior for this action is based on the following Coraza directives and rules from v4.14.0 of the CRS: Included in these rules is an outbound anomaly score threshold of 4 and a paranoia level of 1.

​
Managing Fallback Behavior (on_error)

If on_error is set to halt (default) and the action encounters an error when forwarding traffic, the Traffic Policy chain will halt and no further actions will be executed. For example, if you have a log action after the owasp-crs-response action, the log action will not be run and the error will be returned. However, if on_error is set to continue, actions that appear after the owasp-crs-response action will still be executed even if the owasp-crs-response action encounters an error.

​
Body Processing

When process_body is enabled, ngrok evaluates rules against the first 4kb of the body. If the body is larger than 4kb, we ignore the portion after the first 4kb.

​
Rule Exclusion

When exclude_rule_ids is configured, ngrok skips evaluation of the specified rule IDs. This allows you to disable specific OWASP CRS rules that may be causing false positives in your environment.

​
Outbound Anomaly Score Threshold Exceeded

If the anomaly score accumulated from matching rules exceeds the threshold, ngrok blocks the request with a HTTP 403 response. The response from your upstream does not make it to the client.

​
Failure to process the body successfully

If ngrok is unable to read the response body successfully, ngrok blocks the response with a HTTP 500 response. The response from your upstream does not make it to the client.

​
Examples

​
Running in block mode

The following configuration demonstrates how to run the owasp-crs-response action in block mode.

​
Example Traffic Policy Document

on_http_response:
  - actions:
      - type: owasp-crs-response
        config:
          on_error: halt

​
Running in test mode

The following configuration demonstrates how to run the owasp-crs-response action in test mode where rules are evaluated but blocks are not enforced.

​
Example Traffic Policy Document

on_http_response:
  - actions:
      - type: owasp-crs-response
        config:
          on_error: continue
      - type: log
        config:
          metadata:
            message: OWASP CRS response action would be ${actions.ngrok.owasp_crs_response.decision} for ${req.url}
            error_code: ${actions.ngrok.owasp_crs_response.error.code}
            error_message: ${actions.ngrok.owasp_crs_response.error.message}
            matched_rules_first_id: ${actions.ngrok.owasp_crs_response.matched_rules[0].id}
            matched_rules_first_message: ${actions.ngrok.owasp_crs_response.matched_rules[0].message}
            matched_rules_first_data: ${actions.ngrok.owasp_crs_response.matched_rules[0].data}

​
Example response from your upstream that ngrok would block

A text/plain response like the following will result in ngrok blocking the response due to potential security leaks i.e. SQL Injection vulnerabilities. 
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'SELECT * FROM users WHERE id = 'abc'' at line 1

​
Action Result Variables

The following variables are made available for use in subsequent expressions and CEL interpolations after the action has run. Variable values will only apply to the last action execution, results are not concatenated.
​
actions.ngrok.owasp_crs_response.decision
string

The action taken for this response.

​
actions.ngrok.owasp_crs_response.anomaly_score
int

The total anomaly score for the response. If it equals to or exceeds the set threshold, it will block the response.

​
actions.ngrok.owasp_crs_response.anomaly_score_threshold
int

The total anomaly score threshold for the response. By default, it is set to 4.

​
actions.ngrok.owasp_crs_response.matched_rules
array of objects

The list of all rules matched by this response that have a non-zero score.

​
matched_rules[i].id
int

The ID of the rule.

​
matched_rules[i].message
string

The text message describing the rule.

​
matched_rules[i].severity
string

The severity of the matched rule.

​
matched_rules[i].data
string

Any extra data about the rule and how it matched the response.

​
actions.ngrok.owasp_crs_response.error.code
string

A machine-readable code describing an error that occurred during the action’s execution.

​
actions.ngrok.owasp_crs_response.error.message
string

A human-readable message providing details about an error that occurred during the action’s execution.