Unable to Save Forms After Enabling ModSecurity

Issue

After enabling ModSecurity with the default settings, forms with more than three fields cannot be saved.

The following error message is displayed in the logs:

ModSecurity: Access denied with code 400 (phase 2). Matched "Operator `Eq' with parameter `0' against variable `REQBODY_ERROR' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [msg "Failed to parse request body."] [data "Request body excluding files is bigger than the maximum expected."]

Environment

Liferay PaaS

Resolution

Increase the request body size limits in the ModSecurity configuration file:

In the webserver service settings, ensure the LCP_WEBSERVER_MODSECURITY environment variable is set to On.
Access the webserver service's shell and navigate to the /etc/nginx/modsec directory.
Open the modsecurity.conf file.
Find the following lines, where the size limit should be set to ~13MB (you will find the description above them explaining that the first line is the file size limit, the second is the non-file related request body data size, which should be as low as possible to reduce the chances of certain types of attacks taking place against your web application firewall):
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
Increase the size for both properties to 30107200 and 301072
To ensure ModSecurity respects the environment variable setting, change the SecRuleEngine directive to use the environment variable.
```
SecRuleEngine ${LCP_WEBSERVER_MODSECURITY}
```
Deploy the changes to apply the updated ModSecurity configuration.

Additional Information

The default size limits are industry standards for Web Application Firewalls (WAFs) to prevent certain types of attacks. Increasing these limits may increase your vulnerability to certain attacks.
Please note that the solution requires customizing the application. This means that your Developer Team should perform it at your discretion. It should also be tested on a lower environment and make a backup of the database before modifying the settings. If you require assistance and consultation, we recommend contacting our GS (Global Services).