Dr. Christopher Kunz

[Mon Nov 13 10:43:24 2006] [error] [client 217.188.206.51] mod_security: Access denied with code 403. Pattern match “!^[0-9a-z]*$” at COOKIE(“PHPSESSID”) [hostname “www.mycustomer.com”] [uri “/”] [unique_id “RVg@PD4ESo4AACcOrJg”]

log messages. Unnecessary to mention that mod_security’s configuration had not be touched. The rule in question is part of the popular ruleset from gotroot.com.

The reason for this is that the whole cookie is transparently encrypted by Suhosin’s cookie encryption feature and the session ID is no longer alphanumeric (since it’s encrypted). Mod_security sees a weird-looking cookie parameter in each request and denies it with the configured response code (which, in our case, is 403).

You can fix the problem by disabling this rule:

SecFilterSelective COOKIE_PHPSESSID “!^[0-9a-z]*$”
SecFilterSelective COOKIE_sessionid “!^[0-9a-z\.]*$”

Just a quick heads-up for everyone who might run into similar problems (like with the Zend platform, that assings “non-standard” session IDs as well). We will mention this in the mod_security and Suhosin chapters in the upcoming second edition of “PHP-Sicherheit”.