Intermittent 403 Errors When Accessing Page

[abroa01]

I encountered an issue where a specific page intermittently returned 403 errors. After refreshing the page multiple times, it would eventually load successfully. However, during that time, the 403 error appeared several times before the page rendered correctly.

Steps to Reproduce:

• Navigate to https://mieauth-prod.os.mieweb.org/.
• Observe intermittent 403 errors.
• Refresh the page multiple times.
• Page eventually loads successfully.

[runleveldev]

The requests were blocked due to (1) HTTP/3.0 support being improperly configured in ModSecurity and (2) the requests didn't contain a Host header, making them look invalid. I'm fixing (1) in a PR but (2) needs to be addressed on the client-side.

ModSecurity: Warning. Matched "Operator `Within' with parameter `HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0' against variable `REQUEST_PROTOCOL' (Value: `HTTP/3.0' ) [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1014"] [id "920430"] [rev ""] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/3.0"] [severity "2"] [ver "OWASP_CRS/3.3.7"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "10.17.0.5"] [uri "/test-notification"] [unique_id "c2fedec3280deaee413d7232935f0def"] [ref "v23,8"]
ModSecurity: Warning. Matched "Operator `Eq' with parameter `0' against variable `REQUEST_HEADERS:Host' (Value: `0' ) [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "532"] [id "920280"] [rev ""] [msg "Request Missing a Host Header"] [data ""] [severity "4"] [ver "OWASP_CRS/3.3.7"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "10.17.0.5"] [uri "/test-notification"] [unique_id "c2fedec3280deaee413d7232935f0def"] [ref ""]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `8' ) [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "81"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.3.7"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "10.17.0.5"] [uri "/test-notification"] [unique_id "c2fedec3280deaee413d7232935f0def"] [ref ""]