Skip to content

superfluous response.WriteHeader call when SecRuleEngine On #307

@Forza-tng

Description

@Forza-tng

When I enable Coraza on a host, I get these lines repeating in my main caddy log.

{"level":"info","ts":1778924053.9293013,"msg":"http: superfluous response.WriteHeader call"}
{"level":"info","ts":1778924055.384399,"msg":"http: superfluous response.WriteHeader call"}
{"level":"info","ts":1778924056.2240324,"msg":"http: superfluous response.WriteHeader call"}
{"level":"info","ts":1778924058.6971262,"msg":"http: superfluous response.WriteHeader call"}
{"level":"info","ts":1778924059.9666855,"msg":"http: superfluous response.WriteHeader call"}
{"level":"info","ts":1778924061.1894848,"msg":"http: superfluous response.WriteHeader call"}

A typical caddy vhost looks like this:

(main) {
	tls /etc/caddy/certs/{args[0]}_fullchain.pem /etc/caddy/certs/{args[0]}_privkey.pem {
		curves x25519mlkem768 x25519 secp521r1 secp384r1 secp256r1
	}
	log {
		output file /var/log/caddy/{args[0]}.log {
			roll_disabled
		}
		format json
	}
	encode zstd br gzip
}

git.tnonline.net:443 {
	import main git.tnonline.net

	coraza_waf {
		load_owasp_crs
			directives `
			Include @coraza.conf-recommended
			Include @crs-setup.conf.example
			Include @owasp_crs/*.conf
			
			SecRequestBodyLimitAction ProcessPartial
	
			SecAuditEngine RelevantOnly
			SecAuditLog /var/log/caddy/coraza_audit_git.tnonline.net.log
			SecAuditLogParts ABFHJKZ
			SecRuleEngine On
		`
	}
	
	root * /var/www/domains/git.tnonline.net/htdocs
	file_server
	@https not path /.well-known/*
	reverse_proxy @https 127.0.0.1:3000 {
		header_up X-Real-Ip {remote_host}
		header_up X-Http-Version {http.request.proto}
	}
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions