[GH-ISSUE #53] compatibility with the ngx_http_rewrite_module #168

New issue

Closed

opened 2026-03-13 16:43:14 +03:00 by kerem · 1 comment

kerem commented

2026-03-13 16:43:14 +03:00

Owner

Originally created by @RekGRpth on GitHub (Jul 22, 2021).
Original GitHub issue: https://github.com/ADD-SP/ngx_waf/issues/53

solve

diff --git a/inc/ngx_http_waf_module_config.h b/inc/ngx_http_waf_module_config.h
index d412315..78698d8 100644
--- a/inc/ngx_http_waf_module_config.h
+++ b/inc/ngx_http_waf_module_config.h
@@ -1168,7 +1168,7 @@ static ngx_int_t ngx_http_waf_init_after_load_config(ngx_conf_t* cf) {
     ngx_http_core_main_conf_t* cmcf;
 
     cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
-    h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers);
+    h = ngx_array_push(&cmcf->phases[NGX_HTTP_REWRITE_PHASE].handlers);
     if (h == NULL) {
         return NGX_ERROR;
     }

Originally created by @RekGRpth on GitHub (Jul 22, 2021). Original GitHub issue: https://github.com/ADD-SP/ngx_waf/issues/53 solve ```diff diff --git a/inc/ngx_http_waf_module_config.h b/inc/ngx_http_waf_module_config.h index d412315..78698d8 100644 --- a/inc/ngx_http_waf_module_config.h +++ b/inc/ngx_http_waf_module_config.h @@ -1168,7 +1168,7 @@ static ngx_int_t ngx_http_waf_init_after_load_config(ngx_conf_t* cf) { ngx_http_core_main_conf_t* cmcf; cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module); - h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers); + h = ngx_array_push(&cmcf->phases[NGX_HTTP_REWRITE_PHASE].handlers); if (h == NULL) { return NGX_ERROR; } ```

kerem

2026-03-13 16:43:14 +03:00

closed this issue
added the
timeout
label

kerem commented

2026-03-13 16:43:30 +03:00

Author

Owner

@ADD-SP commented on GitHub (Jul 22, 2021):

The reason we actively dropped compatibility with ngx_http_rewrite_module is that if we wanted to configure the module in blocks location and if, we would have to wait for nginx to locate the corresponding location based on the URI, but this is done in phase NGX_HTTP_FIND_CONFIG_PHASE. If the module is mounted to NGX_HTTP_REWRITE_PHASE, only partial compatibility will be achieved.

Since it is not fully compatible, and since the previous compatibility scheme did not conform to the module development specification, we decided to discontinue compatibility with ngx_http_rewrite_module and mount the module to NGX_HTTP_ACCESS_PHASE.

This does not actually affect the security checks, since in most cases the response the client receives is generated in the phase NGX_HTTP_CONTENT_PHASE.

@ADD-SP commented on GitHub (Jul 22, 2021): The reason we actively dropped compatibility with `ngx_http_rewrite_module` is that if we wanted to configure the module in blocks `location` and `if`, we would have to wait for nginx to locate the corresponding `location` based on the URI, but this is done in phase `NGX_HTTP_FIND_CONFIG_PHASE`. If the module is mounted to `NGX_HTTP_REWRITE_PHASE`, only partial compatibility will be achieved. Since it is not fully compatible, and since the previous compatibility scheme did not conform to the module development specification, we decided to discontinue compatibility with `ngx_http_rewrite_module` and mount the module to `NGX_HTTP_ACCESS_PHASE`. This does not actually affect the security checks, since in most cases the response the client receives is generated in the phase `NGX_HTTP_CONTENT_PHASE`.